How to Secure a WordPress Site: A Practical Checklist
Most WordPress hacks are not clever. They are automated scripts trying thousands of sites a day, looking for the same predictable weaknesses: an admin username of “admin” with a guessable password, a plugin untouched for two years, or a login page with no limit on failed attempts.
None of that requires a skilled attacker, just a script and a bit of time, and it finds the sites that skipped the basics. The good news is the basics cover most of the risk, and none require you to be technical. This checklist works through what actually matters, in a rough order of priority, and sits alongside the rest of GoodHost’s WordPress hosting knowledge centre.
Short answer: Securing a WordPress site means keeping core, plugins and themes updated, using strong unique passwords with two-factor authentication, limiting login attempts, removing unused plugins, and relying on host-level protection such as malware scanning and a web application firewall. Backups make sure a breach is a recovery job, not a disaster.
What actually gets a WordPress site hacked in the first place?
The overwhelming majority of compromises trace back to outdated software, weak or reused passwords, and vulnerable plugins, not sophisticated targeted attacks. Automated bots scan huge numbers of sites looking for known, published vulnerabilities in specific plugin versions, then exploit whichever ones they find unpatched.
This matters because it changes where to focus your effort. In most cases you are not defending against a hacker who picked your site specifically. You are defending against automated tools that move on the moment they hit a site that has done the basics properly.
What should you do first to secure a WordPress site?
Start with the three changes that close off the most common attack paths: update WordPress core, every plugin and your theme to their current versions, remove any plugin or theme you are not actually using, and replace default or weak admin passwords with strong, unique ones stored in a password manager.
- Update WordPress core, all active plugins and your theme, and check for updates weekly rather than waiting for a prompt.
- Delete any deactivated plugin or theme entirely rather than leaving it installed, since an inactive plugin can still be exploited.
- Change any default or weak admin password immediately, and make sure no account still uses “admin” as its username.
- Turn on two-factor authentication for every user with publishing or admin access, not just the site owner.
- Limit login attempts so an automated script cannot keep guessing passwords indefinitely.
Test major updates on a staging copy first if the site is business-critical, since an update can occasionally break something, but do not delay security-specific patches, which are usually flagged separately. Be deliberate about what you install too: every plugin is someone else’s code running on your site, and a plugin nobody has updated in three years is a risk even if it still works.
What login and access controls actually make a difference?
Strong, unique passwords and two-factor authentication stop most automated login attacks outright, because a script guessing passwords cannot get past a one-time code it does not have. Limiting failed login attempts before a temporary lockout closes the door on brute-force attempts entirely.
- Use a unique password for WordPress that is not reused anywhere else, ideally generated and stored in a password manager.
- Turn on two-factor authentication for all admin and editor accounts.
- Limit login attempts, locking out an IP address temporarily after a handful of failed tries.
- Review user accounts periodically and remove access for anyone who no longer needs it.
If your site runs a store, this matters even more, since a compromised admin account can expose order and customer data on top of the site itself. Our guide on what a WooCommerce store actually needs from its hosting touches on that.
What should your hosting provider be doing for you?
A reasonable hosting provider handles server-level protection you cannot configure from inside WordPress: malware scanning, account isolation from other customers on the same server, a firewall filtering malicious traffic before it reaches your site, and backups to restore from if something goes wrong.
| Protection | What it does |
|---|---|
| Free SSL certificate, auto-renewed | Encrypts traffic between visitors and the site, and is table stakes for any legitimate site today |
| Daily malware scanning | Checks site files against known malware signatures on an ongoing basis |
| Imunify360 security | Server-level protection against common attack patterns, including a web application firewall |
| CloudLinux isolated accounts | Keeps each hosting account separated from others on the same shared server |
| Daily backups with JetBackup restores | Gives you a recent, restorable copy of the site if the worst happens |
These come included on GoodHost’s cPanel hosting plans as standard. They will not replace good WordPress-level practice, updates, strong passwords, sensible plugin choices, but they close off the layer of risk that sits below WordPress itself, at the server.
How do backups fit into a security plan?
Backups do not prevent a compromise, but they turn one from a disaster into an inconvenience. If a site is hacked and everything else has failed, a recent, tested backup means restoring a clean version rather than rebuilding from nothing or paying to have the damage undone.
Check that backups run on a schedule you are comfortable with, daily is standard, and that you know how to trigger a restore before you ever need to. A backup you have never tested restoring is one you are only assuming works. Our comparison of WordPress hosting versus general web hosting covers what tends to be included at each level.
How do you know if a site has already been compromised?
Watch for unexplained new admin users, files you did not create in the theme or plugin folders, the site redirecting visitors elsewhere, a sudden spike in outbound traffic or emails, or search engines flagging the site as unsafe. Any one of these is worth investigating immediately.
If you spot any of these signs, change all passwords immediately, from a device you trust, and run a malware scan straight away. A managed hosting setup with scanning already switched on will often catch this before you do. Our explainer on what managed WordPress hosting actually includes covers what to expect there.
Frequently asked questions
How often should I update WordPress plugins?
Check for updates at least weekly, and apply security-specific patches as soon as they are released rather than batching them with routine updates. Set a recurring reminder if your site does not have automatic updates switched on for plugins, so nothing sits unpatched for long.
Is a security plugin necessary if my host already scans for malware?
Host-level scanning covers server and file-level threats, but a WordPress security plugin can add site-specific features like login attempt limiting and activity logging. The two are complementary rather than duplicates, though you do not necessarily need both if your host’s protection already covers login security.
Does changing my login URL from wp-admin actually help?
It reduces the volume of automated login attempts that reach the real login form, since many bots only try the default URL, but it is not a substitute for strong passwords and two-factor authentication. Treat it as a minor extra layer, not core protection.
What should I do immediately if I think my site has been hacked?
Change every password associated with the site, including hosting and FTP logins, run a malware scan, and restore from the most recent clean backup if the scan confirms an infection. Contact your host’s support team if you are not confident doing this yourself.
Do I need an SSL certificate even if my site does not take payments?
Yes. SSL encrypts the connection between visitor and server regardless of whether payments are involved, and browsers now flag non-SSL sites as “not secure” to visitors, which affects trust and, for most legitimate hosts, comes included at no extra cost.
If you want a fuller picture of what host-level protection actually covers before you tick off the rest of this checklist, GoodHost’s security page sets out what runs underneath every cPanel account.