Most WordPress sites are not breached by a determined attacker who has studied the owner. They are breached by automated tools that try known passwords and known plugin flaws against thousands of sites at once. That is good news: the defenses that stop the majority of these attempts are simple, free, and repeatable.

The threat model for a small site

Three things cause most incidents: an outdated plugin or theme with a public vulnerability, a reused or weak password, and an unnecessary administrator account. The attacker does not need to understand your business. They need one unpatched file or one leaked password that also works elsewhere.

If you handle customer data or payments, add a fourth concern: what is stored, where, and for how long. Collect less, keep it briefly, and protect what remains.

Updates are the habit that matters most

Enable automatic updates for minor WordPress releases and for plugins you trust. Major releases deserve a manual look, especially on a site with many plugins; take a fresh backup first, then update. Delete plugins and themes you do not use instead of leaving them deactivated. An inactive plugin is still code on disk and can still be exploited.

Do not postpone updates for months. A monthly routine is enough for a small site, and a weekly glance at the dashboard catches security releases faster.

Make logins hard to guess and hard to reuse

Use a password manager and give every account a unique password of at least sixteen characters. Never reuse the password from your email account, because email is the recovery path for everything else. Do not create a user called admin, and do not keep the default administrator name on a site that anyone can reach.

Add two-factor authentication through a reputable plugin or your host's login protection, and store the recovery codes offline. Limit login attempts so repeated guessing is slowed down, and change the login URL only if you understand that it is obscurity, not security.

Give every account the least privilege it needs

  • Administrator is for people who manage plugins, users, and settings. Keep the number small.
  • Editor can publish and manage other people's posts, which is enough for most contributors.
  • Author and Contributor fit occasional writers who should not touch site configuration.
  • Subscriber is for memberships and nothing else.

Review the user list every few months. Remove accounts for people who no longer work on the site, and reset passwords for anyone who left on poor terms. If a plugin creates its own accounts, know what they can do.

Keep plugins lean and files locked down

Every plugin is code written by someone else with access to your site. Install from reputable sources, read the changelog, and prefer plugins that are actively maintained. Never use a nulled or cracked plugin; the cost of a license is small compared with a backdoor. Remove a plugin completely when you stop using it, including its database tables if the plugin offers a cleanup option.

On the server, directories should generally be 755 and files 644. Add define('DISALLOW_FILE_EDIT', true); to wp-config.php to disable the built-in editor, and keep debug output off in production. These steps reduce the damage from a stolen admin session; they do not replace updates.

A WAF filters traffic; it does not fix your site

A web application firewall inspects requests before they reach WordPress and blocks obvious attacks such as injection patterns and known exploit paths. Some hosts and CDNs include one. It is a useful layer, but it cannot patch a vulnerable plugin or stop an attacker who already has valid credentials. Treat it as an alarm and a filter, not a substitute for maintenance.

HTTPS belongs in the same category of basics. A certificate protects data in transit and is expected by browsers; the setup is explained in free SSL explained.

Backups, detection, and a response plan

Keep at least one backup outside your hosting account, on a different provider, and test a restore before you need it. Confirm what your host does and does not back up, and do not assume a copy exists. A backup is only useful if you know how to put it back.

If the site is compromised, change all passwords, including database and hosting credentials, restore from a clean backup taken before the intrusion, and update everything before reopening. Look for the entry point rather than only cleaning the symptom, and tell your users if their data may have been exposed. The setup steps in WordPress in 30 minutes cover the initial configuration that makes this routine easier. When you are ready to host a hardened site, open a free account and start with a clean install.

Related reading: Hardening WordPress after install · Fixing a 500 error

Create your free account — 5 GB disk, free SSL, no card required.