WordPress security: 8 essential steps

WordPress is as secure as the way it is maintained. Most of the hacked sites we have cleaned up had the same, easily fixable problems.

The essential steps

1. Regular updates of WordPress, the theme and plugins.
2. Strong passwords and a separate account for each user, never one shared administrator account.
3. Two-factor login for administrators.
4. Only the plugins you need. If you don’t use a plugin, delete it.
5. Plugins and themes from trusted sources, never “nulled” versions of paid plugins.
6. Automatic backups stored separately, with a check that they can actually be restored.
7. An SSL certificate and HTTPS across the whole site.
8. Limited login attempts and spam protection on forms.

Codema tip Check the list of users on your site. Old accounts of former collaborators and agencies are a common and forgotten way in.

How to tell your site has been attacked

• Google shows a warning or strange titles in the results.
• The site redirects to other pages, especially on mobile.
• Unknown users or files have appeared.

If you notice any of this, don’t delete anything blindly. Get in touch: we first make a copy, then clean up and close the hole.