WordPress Security Best Practices: A Complete Checklist

Most WordPress Hacks Are Preventable

The large majority of compromised WordPress sites aren't hacked through some sophisticated attack. They're hacked through an outdated plugin with a known, published vulnerability, a weak or reused password, or a theme downloaded from somewhere it shouldn't have been. This checklist covers the habits that close off almost all of that.

Keep Everything Updated

WordPress core, your active theme, and every installed plugin all receive security updates when vulnerabilities are found and fixed. An outdated plugin with a known, public vulnerability is one of the most common ways a WordPress site gets compromised, since attackers can search specifically for sites still running the vulnerable version. Check for updates at least weekly, and apply security-related updates promptly rather than letting them queue up.

Use Strong, Unique Passwords and Two-Factor Authentication

Every admin account needs its own strong password, not a reused one from another site. Two-factorTwo-factor authentication (2FA) — a second login step, like a phone code, required on top of your password. authentication adds a second check beyond the password itself, so a leaked or guessed password alone isn't enough to get in. Most security plugins, including the ones covered in our WordPress security plugin comparison, include two-factor authentication as a standard feature.

Only Use Reputable Themes and Plugins

Stick to WordPress.org's official plugin and theme directories, or well-known, named marketplaces. A free theme or plugin from an unfamiliar site is a common way malicious code enters a site before it's even launched. If a plugin hasn't been updated in a long time, or has very few installs and no reviews, treat that as a warning sign rather than a bargain.

Remove What You're Not Using

Every installed plugin and theme, even an inactive one, is a potential point of entry if it has a vulnerability. Delete plugins and themes you're not actively using instead of just deactivating them.

Limit Login Attempts

Automated bots constantly try common username and password combinations against WordPress login pages. Rate limiting login attempts, available in most security plugins, blocks this kind of brute-forceAn attack that rapidly tries many username and password combinations until one works. guessing after a handful of failed tries.

Back Up Before You Need To

A current, working backup is what turns a hack from a disaster into a quick recovery. See How to Back Up and Restore Your Website in cPanel for how to set this up, and How to Recover a Hacked WordPress Site for what to do if it comes to that.

Use HTTPS Everywhere

SSLThe certificate technology behind HTTPS. Modern 'SSL' is really TLS, but the name stuck. isn't just about the padlock icon: an unencrypted connection can expose login credentials in transit. See SSL Certificates Explained for what it protects and how it's included with hosting.

Let Good Hosting Do Some of the Work

Server-level protections, like ModSecurityA web application firewall available on most cPanel hosting. It blocks many known attack patterns before they reach your code. and cPHulkcPanel's built-in brute-force protection, which blocks an IP after repeated failed logins., add a layer of defense underneath WordPress itself. See cPanel Security Features Explained for the security tools available at the hosting level, and How to Choose the Best Web Hosting Provider in Rwanda for what to look for generally.

Know What You're Defending Against

See The Most Common Website and Server Attacks Explained for how brute-force attempts, SQL injectionAn attack that smuggles malicious database commands through an input the site failed to sanitize., malwareMalicious software planted on a site or server, often to steal data, send spam, or host scam pages. uploads, and other common attacks actually work, so this checklist makes sense as more than a list of rules to follow blindly.

None of these steps individually guarantee safety, but together they close off almost every common way a WordPress site actually gets compromised.