Most hacked WordPress sites aren’t targeted — they’re found by automated bots probing for known weaknesses. Close those weaknesses and you become a far harder, less worthwhile target. This is the practical, prioritised checklist we apply, explained so you understand why each step matters.
Think in layers
Security isn’t one switch; it’s layers an attacker has to defeat in turn. Miss one and the rest still protect you. Here’s the stack this checklist builds:
Your WordPress defence-in-depth
Strong logins— passwords, 2FA, attempt limits
Hidden entry points— custom login URL
Current code— core, theme & plugin updates
Active monitoring— malware scans, Imunify360
Recoverability— off-server backups
Each layer an attacker must defeat → your site
1. Lock down the login
1
Strong, unique passwords
Use long passphrases for every admin, stored in a password manager — never reused elsewhere.
2
Two-factor authentication
Add 2FA so a stolen password alone can’t log in. Apply it to every administrator.
3
Limit login attempts
Cap failed tries and lock out repeat offenders to stop brute-force bots.
4
Move the login URL
Change the default /wp-admin path so automated tools can’t find your login at all.
2. Keep everything current
Outdated core, themes and plugins are the number-one cause of compromised sites. Updates are security fixes as much as features.
Our policy, and why
On shared hosting we host WordPress only if you keep it updated at regular intervals — outdated installs endanger the whole server. Our Managed WordPress plans take this off your plate by handling updates and patching for you.
Update on a schedule, test important sites on staging first, and remove any theme or plugin you don’t use — dormant code is still an entry point.
3. Reduce your attack surface
1
Remove the default “admin” user
Create a uniquely-named administrator, then delete or downgrade “admin”.
2
Delete unused themes & plugins
Keep your active set plus one default theme as a fallback; delete the rest.
3
Disable the file editor
Stop attackers editing code through the dashboard by disabling the built-in editor in wp-config.php.
// Add to wp-config.php to disable the dashboard file editor
define( 'DISALLOW_FILE_EDIT', true );
4. Monitor and protect
Install a security plugin to scan for malware and alert you to changed files and failed logins. Our servers add Imunify360 real-time scanning and a firewall on top, but your own monitoring catches application-level issues first.
5. Be able to recover
Even the best-secured site should have a way back. Keep automated, off-server backups of files and database, and test a restore occasionally. If the worst happens, a clean recent backup turns a disaster into an inconvenience.
Layer
Tool/Setting
How often
Logins
2FA + attempt limit
Set once
Updates
Core/theme/plugin
Weekly
Scanning
Security plugin + Imunify360
Continuous
Backups
Off-server, automated
Daily/weekly
Key takeaway
Secure logins, prompt updates, a reduced attack surface, active monitoring and tested off-server backups — applied as layers — stop and survive virtually every WordPress attack. Start with 2FA and updates today.
Frequently asked questions
Keeping WordPress, themes and plugins updated, closely followed by strong logins with two-factor authentication. Together they prevent the large majority of compromises.
Yes — they complement each other. Server protection like Imunify360 guards the server; a plugin watches your specific WordPress install for file changes, failed logins and vulnerable components.
Take a backup, change all passwords, update everything, scan and clean with a security plugin, remove unknown admin users and files, then consider restoring a known-clean backup. Contact our support for help.
It won’t stop a determined attacker alone, but it dramatically cuts automated brute-force traffic, which is most login attacks. It’s a cheap, effective extra layer.