Blog

How to Secure Your WordPress Website: A Beginner’s Guide

Running a WordPress website is an exciting project, whether you’re building a personal portfolio, publishing a blog, running an online store, or managing a small-business website.

Unfortunately, websites are also under constant attack.

That doesn’t necessarily mean someone is sitting at a computer targeting your business personally. Much of the malicious traffic hitting WordPress websites comes from automated bots that continuously scan the internet looking for outdated plugins, weak passwords, vulnerable forms, exposed login pages, and other easy ways in.

The good news is that you don’t have to be a programmer or cybersecurity expert to make a WordPress website dramatically harder to compromise.

The key is layered security.

Instead of depending on one plugin or one password, you create several barriers. If an attacker gets past one, another is waiting behind it.

Here’s how.

1. Protect Your WordPress Login

Your WordPress login is one of the most obvious places for an attacker to start.

Automated systems can repeatedly attempt usernames and passwords against /wp-login.php, sometimes using credentials stolen in unrelated data breaches.

Don’t Use “admin” as Your Username

If your administrator account is named admin, attackers already know half of the username-and-password combination they need.

For an existing website, don’t simply delete the account and hope for the best.

Instead:

  1. Create a new administrator account with a unique username.
  2. Log out.
  3. Log in using the new account.
  4. Delete the old admin account.
  5. When WordPress asks what to do with its posts and pages, assign the content to your new account.

Your public display name does not need to be the same as your login username.

Use a Password Manager

Passwords should be long, unique, and impossible to guess.

Don’t reuse the password you use for Gmail, Facebook, your hosting company, or another website.

A password manager can generate and store passwords such as:

7Z!eQ$4nVf#93Lx@2pR8

You don’t need to memorize it. That’s the password manager’s job.

Turn On Two-Factor Authentication

Two-factor authentication, or 2FA, is one of the most important protections you can add.

With 2FA enabled, knowing the password isn’t enough. A successful login also requires a temporary code or another authentication method.

Enable 2FA at minimum for:

  • Administrators
  • Developers
  • Editors
  • Anyone else capable of changing or publishing website content

If your security plugin supplies recovery codes, save them somewhere secure other than the same phone containing your authenticator app.

2. Stop Brute-Force Login Attacks

A strong password helps, but there’s little reason to let a bot try thousands of passwords in the first place.

Your security software should limit repeated login attempts.

Recommended Wordfence Starting Settings

If you’re using Wordfence, go to:

Wordfence → Firewall → All Firewall Options → Brute Force Protection

A reasonable starting configuration based on Wordfence’s current recommendations is:

  • Enable brute-force protection: ON
  • Lock out after login failures: 20
  • Lock out after forgot-password attempts: 5
  • Count failures over: 5 minutes
  • Lockout duration: Consider 60 minutes
  • Enforce strong passwords: Administrators and publishing users
  • Don’t let WordPress reveal whether a username is valid: ON
  • Prevent username discovery through author scans and related APIs: ON

For a small business website with only one or two administrators, you may also consider immediately blocking attempts using invalid usernames. On a membership site with many legitimate users, that setting can cause unnecessary lockouts.

Wordfence specifically recommends 20 failed login attempts and 5 password-reset attempts as starting values, along with preventing username enumeration and enforcing strong passwords.

3. Use a Real WordPress Security Plugin — and Configure It

Installing a security plugin and never opening its settings isn’t enough.

A good WordPress security plugin can provide several different protections:

  • Web Application Firewall, or WAF
  • Brute-force protection
  • Malware scanning
  • File integrity monitoring
  • Two-factor authentication
  • Login protection
  • IP blocking
  • Security alerts
  • Vulnerability notifications

Wordfence

For many small and medium WordPress websites, Wordfence is a good all-in-one starting point.

After installing it, don’t stop at activation.

Go to the firewall settings and optimize the firewall.

Wordfence calls this Extended Protection. Instead of waiting until WordPress has already begun loading, Extended Protection allows the firewall to load earlier and inspect PHP requests before WordPress and potentially vulnerable plugins execute.

Also verify that:

  • Firewall status eventually shows Enabled and Protecting
  • Protection Level shows Extended Protection
  • Daily scans are enabled
  • 2FA is enabled for administrators
  • Brute-force protection is configured
  • Security alerts go to an email address you actually monitor

Don’t ignore repeated malware, changed-file, or vulnerability warnings.

Patchstack

Patchstack takes a somewhat different approach and is particularly focused on vulnerabilities in WordPress plugins, themes, and core.

Its protection can apply targeted virtual patches to known vulnerable components, providing protection while you’re waiting for an official software update or while you test an update before deploying it.

This can be especially useful for businesses, developers, agencies, and sites with larger collections of plugins.

Important: Don’t Install Five Security Plugins

More security plugins do not necessarily equal more security.

Running several all-in-one security plugins simultaneously can create:

  • Duplicate firewalls
  • Conflicting login rules
  • Performance problems
  • Duplicate scans
  • Confusing alerts
  • Accidental lockouts

Choose a primary security system and configure it properly.

You can complement it with specialized tools, such as a honeypot or external firewall, when they solve a different problem.

4. Add Honeypots to Trap Automated Spam Bots

This is an inexpensive and often overlooked layer of protection.

A honeypot is a hidden trap designed for bots.

Imagine placing an invisible field inside your contact form. A human visitor can’t see it and therefore won’t fill it out.

A simplistic spam bot sees a form field and fills it automatically.

Gotcha.

The website now knows the submission probably came from a bot and can reject it.

Honeypots are particularly useful for:

  • Contact forms
  • Comment forms
  • User registration
  • Newsletter forms
  • Lead-generation forms
  • Forum registrations

WP Armour Honeypot Anti Spam

One option is WP Armour – Honeypot Anti Spam, which currently provides honeypot protection for WordPress registration, comments, Contact Form 7, WPForms, Gravity Forms, Formidable Forms and several other form systems.

The advantage of a honeypot is that legitimate visitors usually don’t have to:

  • Identify traffic lights
  • Solve puzzles
  • Click “I am human”
  • Wait through an external CAPTCHA challenge

Honeypots Are Not Firewalls

This distinction matters.

A honeypot can be extremely useful against automated form spam, but it does not replace:

  • A firewall
  • Malware scanning
  • 2FA
  • Vulnerability protection
  • Software updates

Think of it as another layer.

For sophisticated automated attacks, you can also consider an anti-bot service or Cloudflare Turnstile, particularly on public-facing forms.

5. Put a Firewall in Front of the Website

A WordPress security plugin operates at the website or server level.

You can add another layer outside WordPress itself.

Services such as Cloudflare sit between visitors and your web server and can inspect incoming traffic before it reaches the site.

Cloudflare’s Web Application Firewall can apply managed security rules and custom rules to incoming requests. Its current documentation includes WordPress-specific managed rules and bot protection options.

This can help reduce:

  • Malicious requests
  • Automated scanning
  • Exploit attempts
  • Certain bots
  • Excessive requests
  • Some denial-of-service traffic

For many business websites, the combination of:

secure hosting + Cloudflare + properly configured WordPress security

provides much stronger protection than relying on WordPress alone.

6. Be Ruthless About Updates

One of the most important WordPress security rules is also one of the simplest:

Update your software.

Vulnerabilities are regularly discovered in plugins, themes, WordPress itself, and server software.

Once a vulnerability becomes public, attackers can automate searches for websites still running the vulnerable version.

WordPress’s own security guidance emphasizes keeping WordPress, plugins, and themes current.

A Good Update Strategy

For most small websites:

  • Allow automatic WordPress security and maintenance updates.
  • Enable automatic updates for well-established, low-risk plugins.
  • Check the website after updates.
  • Back up before major upgrades.
  • Test major changes on staging when practical.

For complex sites—especially WooCommerce, membership sites, or websites with extensive custom functionality—you may prefer controlled updates after testing.

Delete Plugins You Don’t Use

Don’t merely deactivate unused plugins.

Delete them.

The same applies to unused themes.

A plugin doesn’t need to be active for every possible vulnerability to be harmless. Unnecessary software simply increases the number of files and components you have to monitor.

Keep:

  • Your active theme
  • A child theme if required
  • One current WordPress default theme as a troubleshooting fallback

Delete the rest unless you have a specific reason to keep them.

Be Suspicious of Abandoned Plugins

Before installing a plugin, check:

  • When it was last updated
  • Whether it supports your current WordPress version
  • Number of active installations
  • Recent reviews
  • Support forum activity
  • Developer reputation

A plugin that hasn’t been updated for years may eventually become a security liability.

Secure WordPress

7. Turn Off Features You Don’t Need

Every unnecessary feature is another potential entry point.

Disable Public Registration If You Don’t Need It

Go to:

Settings → General

Look for:

Anyone can register

If you don’t intentionally allow visitor accounts, turn it off.

Disable the Built-In Plugin and Theme Editor

WordPress administrators can normally edit PHP files directly inside the dashboard.

That’s convenient.

It’s also dangerous if an attacker gains administrator access.

WordPress itself documents the option of disabling its built-in theme and plugin editors as a security precaution.

An administrator or developer can add this to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

If you’re uncomfortable editing wp-config.php, ask your host or developer to do it.

Review XML-RPC

WordPress’s xmlrpc.php interface is required by some applications and services but is also frequently targeted by automated attacks.

Don’t blindly disable it.

For example, Jetpack and some remote publishing tools may rely on XML-RPC functionality. Cloudflare specifically warns that completely blocking it can interfere with Jetpack.

If nothing on your site requires XML-RPC authentication, your security plugin may offer an option to restrict or disable it.

Review Application Passwords

WordPress Application Passwords allow external applications to authenticate without using your normal login password.

They’re useful when needed.

If your site doesn’t use external applications or integrations requiring them, consider restricting them through your security configuration.

Again, don’t disable features blindly. Security settings that break your payment gateway, website management service, Jetpack, mobile app, CRM, or API aren’t useful security settings.

8. Don’t Give Everyone Administrator Access

Not every employee, writer, contractor, or client needs full control of the website.

WordPress includes user roles for a reason.

Give users the minimum permissions necessary to do their jobs.

For example:

  • A blog writer may only need Author or Editor access.
  • A customer needs Customer access.
  • A store employee may need Shop Manager.
  • Only people responsible for site configuration should usually have Administrator access.

Periodically visit:

Users → All Users

Look for:

  • Accounts belonging to former employees
  • Old developer accounts
  • Forgotten test users
  • Duplicate administrators
  • Accounts you no longer recognize

Delete or downgrade anything that no longer requires privileged access.

9. Protect Your Contact Forms and Registration Forms

A contact form is effectively a doorway that accepts information from strangers on the internet.

Protect it accordingly.

Depending on the site, use one or more of:

  • Honeypot protection
  • Cloudflare Turnstile
  • Rate limiting
  • Email validation
  • Submission limits
  • Spam filtering
  • File-type restrictions
  • File-size restrictions

Be Especially Careful With File Uploads

If visitors can upload files, restrict both the file types and file sizes they can submit.

A contact form rarely needs to accept:

  • .php
  • .exe
  • .js
  • shell scripts
  • arbitrary archives

Allow only the formats genuinely required by your business.

For example:

jpg, jpeg, png, pdf, doc, docx

Even then, uploaded files should be treated as untrusted data.

10. Use HTTPS Everywhere

Your site should load exclusively through:

https://

not:

http://

HTTPS encrypts information traveling between a visitor’s browser and your server.

That includes login information, form submissions, session data, and other traffic.

Your hosting provider should provide an SSL/TLS certificate, and HTTP requests should redirect automatically to HTTPS.

Also make sure your WordPress Address and Site Address use HTTPS under:

Settings → General

Seeing the padlock doesn’t mean the website is hack-proof, but running a login or business website without HTTPS is unacceptable today.

11. Back Up the Website – Somewhere Else

Security isn’t only about preventing an attack.

It’s also about recovering from one.

You should maintain automatic backups of:

  • WordPress files
  • Database
  • Uploads
  • Themes
  • Plugins
  • Important configuration

Don’t Keep Your Only Backup on the Same Server

If the server is corrupted, compromised, deleted, or inaccessible, a backup stored only on that server may disappear with it.

Keep an additional copy somewhere separate.

Depending on your setup, that may include:

  • Your hosting provider’s external backup system
  • Google Drive
  • Dropbox
  • Amazon S3
  • Remote backup storage
  • Local encrypted storage

Backup plugins such as UpdraftPlus are one option, although many quality managed WordPress hosts already provide automated backups.

Test Your Backups

A backup you’ve never restored is only a theory.

Periodically verify that you know how to restore the site.

Ideally, test a restoration on a staging site rather than discovering during an emergency that your backups were incomplete.

12. Scan for Malware and Unexpected File Changes

A firewall tries to stop malware from getting in.

A scanner helps determine whether something already has.

Your security system should periodically examine the website for:

  • Known malware
  • Suspicious PHP files
  • Modified WordPress core files
  • Unexpected JavaScript
  • Backdoors
  • Malicious redirects
  • Injected SEO spam
  • Changed plugin files

Wordfence, for example, can compare WordPress core, plugin, and theme files against repository versions and scan for known malicious patterns.

Don’t assume that a website is clean simply because it still looks normal.

Many compromises are intentionally difficult to notice.

13. Monitor What’s Happening Behind the Scenes

Security logs can tell you things that your website’s front end cannot.

Monitor:

  • Successful administrator logins
  • Failed login attempts
  • New administrator accounts
  • Plugin installations
  • Plugin deletions
  • File changes
  • Security setting changes
  • Large spikes in blocked traffic

If you normally log in from Arizona and suddenly see successful administrator logins from several foreign IP addresses at 3:00 a.m., that’s worth investigating.

The goal isn’t to obsess over every blocked bot. Internet-facing websites receive malicious traffic constantly.

Look for changes in behavior and successful suspicious actions.

14. Secure Your Hosting Account and Email Too

You can secure WordPress beautifully and still lose the entire site if an attacker compromises your hosting account.

Turn on 2FA for:

  • WordPress
  • Hosting account
  • Domain registrar
  • Cloudflare
  • Business email
  • Backup provider
  • Password manager

Your email account is particularly important because password-reset messages usually go there.

If someone controls your email, they may be able to reset passwords for several other services.

15. Use Secure Hosting

Your hosting company is part of your security system.

Look for a provider offering features such as:

  • Current PHP versions
  • Server-level firewalls
  • Malware monitoring
  • Automatic backups
  • Free SSL/TLS
  • Account 2FA
  • Server isolation
  • DDoS mitigation
  • Staging sites
  • Easy restoration
  • Responsive security support

Avoid hosting that leaves outdated PHP versions running indefinitely or makes backups an afterthought.

A $3 hosting account isn’t a bargain if recovering a compromised business website costs thousands of dollars.

16. Don’t Rely on Hiding the Login Page

You’ve probably seen plugins that change:

/wp-login.php

to something like:

/secret-office-login/

This may reduce junk traffic and automated login noise, but it should not be considered your primary security system.

A hidden URL does not replace:

  • 2FA
  • Strong passwords
  • Login rate limiting
  • A firewall
  • Updates

Security professionals call this concept security through obscurity.

Obscurity can be an additional layer, but the site should remain secure even if an attacker discovers the hidden login address.

A Simple Security Stack for a Small WordPress Website

If all of this sounds overwhelming, start here.

For a typical small-business WordPress site, a sensible security stack might look like this:

At the Server/DNS Level

Secure WordPress host

Provides SSL, backups, current server software, and server-level protection.

Cloudflare

Provides another external layer for firewall rules, traffic filtering, rate limiting, bot management options, and related protections.

Inside WordPress

Wordfence

Use it for:

  • Firewall
  • 2FA
  • Brute-force protection
  • Malware scanning
  • File integrity
  • Login monitoring

WP Armour or another compatible honeypot

Use it to reduce automated form and registration spam.

Off-site backup system

Use your host’s backup service or a plugin/service that sends backups somewhere other than your production server.

That’s already a much stronger setup than simply installing WordPress and hoping for the best.

WordPress Security Checklist

Before considering your site reasonably protected, verify the following:

  • WordPress core is current.


  • Plugins are current.


  • Themes are current.


  • Unused plugins have been deleted.


  • Unused themes have been deleted.


  • Administrator username is not admin.


  • Every administrator has a unique strong password.


  • 2FA is enabled for privileged users.


  • Brute-force protection is enabled.


  • A WordPress firewall is active.


  • Malware scans run automatically.


  • Security alerts go to a monitored email address.


  • User enumeration is restricted where practical.


  • Public registration is disabled unless required.


  • Contact and registration forms have anti-bot protection.


  • File uploads are restricted.


  • HTTPS is enforced.


  • Automatic backups are running.


  • At least one backup exists outside the production server.


  • You know how to restore a backup.


  • Old administrator accounts have been removed.


  • Hosting account has 2FA.


  • Domain registrar has 2FA.


  • Business email has 2FA.

Security Is Maintenance, Not a One-Time Installation

The most dangerous misconception in website security is:

“I installed a security plugin, so I’m secure.”

Website security isn’t a product you install once.

It’s an ongoing process.

Plugins change. Vulnerabilities are discovered. Employees leave. Passwords leak. Bots evolve. New WordPress versions appear. Backups fail. Websites that were perfectly secure six months ago may have completely different risks today.

That is why a WordPress website should be periodically reviewed for:

  • Updates
  • Vulnerabilities
  • Malware
  • Failed backups
  • Old user accounts
  • Suspicious login activity
  • Expired SSL certificates
  • Unnecessary plugins
  • Form spam
  • Security configuration changes

For a business website, regular professional maintenance isn’t simply about changing text and installing updates. It is part of protecting the business asset the website represents.

The goal isn’t to make your WordPress website mathematically impossible to hack.

Nothing connected to the internet can promise that.

The goal is to make your website difficult to compromise, quick to detect when something is wrong, and easy to recover if something happens.

That is what good website security looks like.