Your WordPress site is a target. Every day, automated bots scan millions of websites looking for vulnerabilities. The good news? Most attacks can be stopped with proper security settings.
This guide walks you through the essential WordPress security settings every site needs. No technical expertise required.
Why WordPress Security Matters
WordPress powers 43% of all websites. That popularity makes it attractive to hackers. A compromised site can lose search rankings, customer trust, and revenue.
But here's the thing. Most WordPress security breaches happen because of basic mistakes. Weak passwords, outdated plugins, poor hosting. Fix these fundamentals and you'll stop 99% of attacks.
Step 1: Secure Your Login Process
Change Your Admin Username
Never use "admin" as your username. It's the first thing hackers try.
- Go to Users in your WordPress dashboard
- Click Add New
- Create a new administrator account with a unique username
- Log out and log back in with the new account
- Delete the old "admin" user
Use Strong Passwords
Your password should be at least 12 characters with mixed case, numbers, and symbols. WordPress has a built-in password generator. Use it.
- Go to Users > Your Profile
- Click Generate Password
- Save the generated password in a password manager
Enable Two-Factor Authentication
Add an extra layer of security with 2FA. Install a plugin like Wordfence or use Google Authenticator.
- Install a 2FA plugin
- Follow the setup wizard
- Save your backup codes somewhere safe
Step 2: Update Everything Regularly
Outdated software is a hacker's best friend. Set up automatic updates where possible.
WordPress Core Updates
- Go to Dashboard > Updates
- Enable automatic updates for minor releases
- Check for major updates monthly
Plugin and Theme Updates
- Review your installed plugins monthly
- Delete any you're not using
- Update the rest immediately when updates are available
Pro tip: Our website maintenance packages handle all updates automatically, plus security monitoring and backups.
Step 3: Configure User Permissions Properly
Not everyone needs admin access. Use the principle of least privilege.
WordPress User Roles
- Administrator: Full control (you only)
- Editor: Can publish and manage posts
- Author: Can publish their own posts
- Contributor: Can write but not publish
- Subscriber: Read-only access
Only give admin access to people who absolutely need it.
Step 4: Secure Your wp-config.php File
This file contains your database passwords and security keys. Protect it.
Security Keys
WordPress uses security keys to encrypt user sessions. Generate new ones:
- Visit the WordPress salt generator
- Copy the generated keys
- Replace the existing keys in wp-config.php
- This logs out all users (including you)
Database Security
Add these lines to wp-config.php to prevent database information from appearing in error messages:
define('WP_DEBUG', false);
define('WP_DEBUG_LOG', false);
define('WP_DEBUG_DISPLAY', false);Step 5: Choose Secure Hosting
Your hosting provider is your first line of defence. Look for:
- Regular security updates
- Malware scanning
- SSL certificates included
- Daily backups
- UK-based servers for better performance
Our UK hosting service includes all these features, plus automatic security monitoring.
Step 6: Install a Security Plugin
A good security plugin monitors your site 24/7. Popular options include:
- Wordfence: Comprehensive security suite
- Sucuri: Excellent malware detection
- iThemes Security: User-friendly interface
Basic Security Plugin Setup
- Install your chosen plugin
- Run the initial security scan
- Fix any identified issues
- Enable real-time monitoring
- Set up email alerts
Step 7: Limit Login Attempts
Brute force attacks try thousands of password combinations. Stop them by limiting login attempts.
Most security plugins include this feature:
- Go to your security plugin settings
- Enable login attempt limiting
- Set maximum attempts (5 is usually enough)
- Set lockout duration (30 minutes minimum)
Step 8: Hide WordPress Version Information
Don't advertise which WordPress version you're running. Add this to your theme's functions.php:
remove_action('wp_head', 'wp_generator');Step 9: Disable File Editing
Prevent hackers from editing your theme files through the WordPress admin.
Add this line to wp-config.php:
define('DISALLOW_FILE_EDIT', true);Step 10: Regular Security Audits
Schedule monthly security checks:
- Review user accounts and permissions
- Check for unused plugins and themes
- Monitor security plugin reports
- Test your backups
- Update emergency contact information
Use our free website audit tool to identify potential security issues automatically.
Common Security Issues and Solutions
"Brute Force Attack Detected"
Solution: Enable login limiting and consider changing your login URL.
"Malware Found"
Solution: Don't panic. Use a security plugin to clean the infection. Change all passwords afterwards.
"SSL Certificate Error"
Solution: Contact your hosting provider. SSL certificates should renew automatically.
"Plugin Vulnerability"
Solution: Update or remove the vulnerable plugin immediately. Check security blogs for alternatives.
Backup Strategy
Security isn't just about prevention. You need recovery plans too.
What to Backup
- Database (posts, pages, comments)
- WordPress files
- Media uploads
- Theme customisations
Backup Frequency
- High-traffic sites: Daily
- Regular updates: Weekly
- Static sites: Monthly
Store backups off-site. Cloud storage or separate hosting accounts work well.
Advanced Security Considerations
Once you've covered the basics, consider these advanced measures:
Content Security Policy (CSP)
Prevents cross-site scripting attacks. Requires technical knowledge to implement properly.
Web Application Firewall (WAF)
Filters malicious traffic before it reaches your site. Available through hosting providers or services like Cloudflare.
Regular Penetration Testing
Professional security testing for high-value websites. Worth considering for ecommerce or professional service sites.
What's Next?
Security is ongoing, not a one-time setup. Create a monthly maintenance routine covering these essentials.
Want professional help? Our WordPress development service includes security hardening as standard. We handle the technical details so you can focus on your business.
Start with the basics in this guide. Your future self will thank you when your site stays online while others get hacked.
Need a security review of your current site? Our team can audit your WordPress security and provide a detailed action plan. Get in touch to discuss your requirements.