How do I secure a WordPress website?
Short answer
Keep WordPress core, themes and plugins updated, delete plugins and themes you do not use, protect admin accounts with strong unique passwords and MFA, limit login attempts, take regular off-site backups, and use HTTPS with security headers.
The details
Most compromised WordPress sites are hit through outdated plugins. Choose plugins that are actively maintained and widely used.
What to do
- Turn on automatic updates for core and trusted plugins.
- Remove unused plugins, themes and admin users.
- Add MFA to every admin account.
- Schedule off-site backups and test a restore.
- Check headers and TLS with a passive scan.
Useful next reads and tools
- Website Security Check · tool
Terms explained
- HTTPS and TLS
- HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
Sources
Related questions
- What are HTTP security headers and which ones should my website have?
- What are SPF, DKIM and DMARC?
- How do I stop someone from spoofing my email domain?
- How do I read email headers to check if a message is fake?
- How can I check if my website is secure?
- What is a DDoS attack and how do I protect a website from one?
Related Guides
GuideWeb Security
How to Protect Your Projects From Malicious npm Packages (and What GitHub's New Package Firewall Does)
GitHub launched a package firewall that blocks risky npm packages before they install. Learn how it works, who can use it and 10 steps any team can take today.
Read more GuideWeb Security
How to Check Security Headers of a Website
Learn how to check security headers of a website using browser developer tools and terminal commands to defend against clickjacking, XSS, and MIME sniffing.
Read more GuideWeb Security
How to Prevent a DDoS Attack (Step-by-Step Guide for 2026)
Protect your website infrastructure from crashing. Learn the 6 best defensive measures to block malicious traffic, implement rate limiting, and stop DDoS attacks before they cost you revenue.
Read more GuideSmall Business Security
10 Small Business Cybersecurity Tips to Reduce Risk Fast
Protect your company with ten practical small business cybersecurity tips. Implement MFA, patch software, secure Wi-Fi, and build backups that work.
Read more