How to Secure a WordPress Website (and What to Do If You’re Hacked)
The security essentials every WordPress site owner should have in place — plus a calm, step-by-step plan if the worst happens.
Kazi Talat
· 7 min read
WordPress itself is secure — most hacks happen because of outdated plugins, weak passwords or poor hosting. The good news: a few habits prevent the vast majority of attacks.
Security essentials
- Update regularly. Core, themes and plugins. Remove anything inactive.
- Strong logins. Unique passwords, two-factor authentication and no generic “admin” username.
- Least privilege. Give users only the role they need.
- Firewall. Cloudflare WAF or Wordfence blocks malicious traffic before it reaches your site.
- Backups. Automated, off-site and tested. A backup you cannot restore is not a backup.
- Good hosting. Isolated accounts, malware scanning and up-to-date PHP.
Signs your site may be hacked
- Visitors are redirected to spam or scam websites.
- Google shows a “This site may be hacked” or “Deceptive site ahead” warning.
- Unknown admin users or files appear.
- Your host suspends the account or reports malware.
What to do if you’re hacked
- Don’t panic and don’t delete everything. Take a backup of the infected site for analysis.
- Change all passwords — WordPress, hosting, FTP and database.
- Scan and clean files and the database, removing backdoors as well as visible malware.
- Find the entry point — usually a vulnerable plugin — and patch it.
- Request a review in Google Search Console to remove warnings.
- Harden and monitor to prevent reinfection.
Cleaning malware without fixing the vulnerability almost guarantees reinfection. Always find the root cause.
Key takeaways
- Most hacks exploit outdated plugins — keep everything updated.
- Use strong passwords, 2FA and limited admin accounts.
- Keep off-site backups you have actually tested.
- Use a firewall like Cloudflare or Wordfence.
