Most WordPress websites that get hacked aren’t targeted personally – automated tools search the internet for websites with known weaknesses. This checklist closes the most common gaps.
We protect our platform behind the scenes too, with firewalls, a web application firewall and malware scanning – see how secure is PAC. These steps protect the parts only you control: your website and your logins.
1. Keep everything up to date
Out-of-date plugins and themes are the most common way in. Update WordPress, plugins and themes regularly, and turn on automatic updates where you can. See how to manage WordPress updates and plugins in Enhance.
2. Remove what you don’t use
Delete plugins and themes you’ve turned off and don’t need. Even inactive ones can be used to break in. Keep one default WordPress theme as a spare.
3. Only install from trusted sources
Get plugins and themes from WordPress.org or the developer’s own website. Never use “free” copies of paid plugins or themes from other websites – they often contain hidden malware.
4. Use strong passwords and two-factor authentication
- Use a strong, unique password for every WordPress user, and avoid the username admin.
- Add two-factor authentication to WordPress using a security plugin.
- Turn on 2FA for your PAC logins too – see how to secure your PAC accounts in 5 minutes.
5. Keep admin access to a minimum
Only give people the access they need. For example, someone who writes blog posts can be an Editor or Author rather than an Administrator. Remove users who no longer need access.
6. Use a current PHP version
Newer PHP versions are faster and get security fixes. See how to change the PHP version of your website.
7. Keep security features switched on
- Force HTTPS, so visitors always use a secure connection – see how SSL certificates work on your website.
- ModSecurity, which blocks many common attacks – see how to turn ModSecurity on or off.
8. Add Patchstack
Patchstack watches your plugins, themes and WordPress for known vulnerabilities, and can block attacks on them before an update is available. See how Patchstack protects your WordPress website.
9. Know how to get back
Your website is backed up automatically, twice a day, with backups kept for 30 days. Take a manual backup before big changes, and keep your own copy of anything important. See how to restore a backup of your website or email.
If the worst happens, see what to do if your website has been hacked.
Worried about your website’s security? Please open a support ticket and we’ll take a look.
