How to Secure a WordPress Site Against Common Attacks

WordPress security settings with two-factor authentication, login limits, firewall, updates and disabled file editing

WordPress powers a huge share of the web, which makes it a popular target for automated attacks. The good news is that most successful attacks are not clever. They exploit weak passwords, outdated plugins, and forgotten admin accounts. Fix those basics and you block the vast majority of threats.

This guide covers the security habits that matter most, in the order that gives you the biggest improvement for the least effort.

How WordPress Sites Usually Get Hacked

Understanding the common entry points makes the rest of this guide easy to prioritize.

Outdated plugins and themes: the most common cause. Once a vulnerability is published, bots scan the web for sites that have not updated.
Weak or reused passwords: bots try thousands of password combinations against the login page.
Nulled premium plugins: pirated copies of paid plugins often contain hidden backdoors.
Too many administrators: every admin account is another door that needs a strong lock.
Insecure hosting: old PHP versions and poorly isolated shared servers.

Five layers of WordPress security: updates, logins, hardening, firewall and monitoring, and backups

Layer 1: Keep Everything Updated

Update WordPress core, themes and plugins regularly. Minor core releases are usually security fixes and can update automatically. For plugins, check the changelog and update at least weekly. Delete plugins and themes you no longer use instead of just deactivating them, because inactive code can still be exploited.

Updates can occasionally break a layout, which is why many site owners delay them. The fix is a safe update routine, not skipping updates. Our guide on updating WordPress plugins without breaking your site explains the process.

Layer 2: Lock Down Logins

Use strong, unique passwords generated by a password manager for every account.
Turn on two-factor authentication for all administrators and editors.
Limit login attempts so bots cannot guess passwords endlessly.
Avoid the username "admin" and do not display login names publicly as author names.
Give users the lowest role they need. A content writer needs Author or Editor, not Administrator.

Layer 3: Harden the Server and WordPress

A few settings make common attacks much harder.

Use HTTPS everywhere with an automatically renewed SSL certificate.
Run a current, supported PHP version. Old versions no longer receive security fixes.
Disable file editing in the dashboard by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php. An attacker who gets into an admin account then cannot edit theme files directly.
Set correct file permissions, typically 755 for folders and 644 for files, with wp-config.php stricter.
Disable XML-RPC if you do not use apps or services that need it.

Choosing Plugins Safely

Every plugin you install adds code that can contain bugs. That does not mean you should avoid plugins, only that you should choose them carefully.

Check when it was last updated. A plugin that has not been updated in a year or more may be abandoned.
Look at active installations and reviews in the WordPress plugin directory, and read recent support threads for unresolved problems.
Prefer fewer, well-maintained plugins over many small ones that each do one tiny thing.
Download only from the official directory or the developer's own site. Free copies of premium plugins from random websites are a common source of malware.

The same thinking applies to Elementor add-on packs. Many sites install several packs and use one widget from each. Elementor now covers much of what those packs once added, so review what you really use.

Layer 4: Add a Firewall and Monitoring

A web application firewall filters malicious traffic before it reaches WordPress. You can use a security plugin, a firewall provided by your host, or a CDN with firewall rules. Combine it with malware scanning and email alerts for file changes and new admin users, so you hear about problems early.

Monthly WordPress security checklist for updates, users, plugins, backups, alerts and SSL

Layer 5: Backups as Your Safety Net

No security setup is perfect. Automatic off-site backups mean that even a successful attack becomes a recovery task rather than a disaster. Follow the 3-2-1 approach from our guide on backing up and restoring WordPress.

Elementor-Specific Security Tips

Buy Elementor Pro and add-ons only from official sources. Never install nulled versions.
Keep Elementor, Elementor Pro and every add-on updated together, since they depend on each other.
Only paste custom code from sources you trust. A malicious script in Custom Code or an HTML widget runs on every visitor's browser. See four ways to add custom code in Elementor for safe practices.
Protect Elementor forms from spam with honeypot fields and CAPTCHA.

Security When You Work with Clients or a Team

Agencies and freelancers often hold the keys to many websites, which makes their own accounts a valuable target.

Create a personal account for every person. Never share one admin login between several people, so you can remove access when someone leaves.
Remove old accounts. When a project ends, delete or downgrade the accounts of contractors who no longer need access.
Store credentials in a shared password manager, not in emails, chats or spreadsheets.
Give clients Editor access unless they truly need to install plugins. Most content work does not require Administrator rights.

A Monthly Security Checklist

Update WordPress core, plugins and themes, then check key pages.
Review the list of users and remove anyone who no longer needs access.
Delete inactive plugins and themes.
Check that backups ran and that one recent copy is off-site.
Review firewall and login alerts for unusual activity.
Confirm the SSL certificate is valid and the PHP version is still supported.

What to Do If Your Site Is Hacked

Put the site in maintenance mode and tell your host.
Change every password: WordPress users, hosting, database, SFTP and email.
Restore a clean backup from before the infection, or have a professional clean the files.
Update everything and remove unknown admin users, plugins and files.
Check Google Search Console for security warnings and request a review once clean.

Start With the Biggest Wins

If this list feels long, start with three actions today: turn on two-factor authentication for every administrator, update or delete every outdated plugin, and confirm that an off-site backup exists. Those three steps alone close the doors that most automated attacks try first. Add the firewall, hardening and monitoring over the following week, and then keep the monthly checklist on your calendar.

Frequently Asked Questions

Do I need a security plugin?

Most sites benefit from one for login protection, firewall rules and malware scanning. Some managed hosts already provide these at the server level, so check what your host includes before adding overlapping tools.

Is changing the login URL worth it?

It reduces automated login noise, but it is not real protection on its own. Strong passwords, two-factor authentication and login limits matter much more.

How often should I review security?

Check updates weekly and review users, plugins and backups once a month. Add it to your website maintenance plan so it never gets skipped.

Wrapping Up

WordPress security is mostly about consistent basics: update often, protect logins with strong passwords and two-factor authentication, harden a few server settings, add a firewall, and keep off-site backups. Do these well and your site stops being an easy target.