Most WordPress sites are broken into through weak passwords or out-of-date plugins. These steps close the common gaps.
In this guide
Strong passwords and two-factor login
- Give every admin user a long password that isn't used anywhere else. A password manager makes this easy.
- Don't use admin as a username.
- Turn on two-factor login with a plugin such as Two Factor or Wordfence.
- Remove admin users who no longer need access.
Limit login attempts
Bots try thousands of passwords on wp-login.php. A plugin such as Limit Login Attempts Reloaded, or the login protection in Wordfence, locks out an address after a few failed tries.
Keep everything updated
Most attacks use flaws that have already been fixed. Update WordPress, your theme and your plugins as soon as updates come out, and delete themes and plugins you don't use.
On WordPress Hosting, we apply WordPress core security updates automatically. Plugin updates are done on request: open a ticket if you want us to run them.
Use a security plugin
A security plugin such as Wordfence adds a firewall, a malware scan and login protection. Use one security plugin, not several. For daily malware scans from outside WordPress, see our SiteLock add-on.
File permissions and wp-config.php
Folders should be 755 and files 644. Never set anything to 777.
To stop anyone editing theme and plugin files from the WordPress dashboard, add this line to wp-config.php:
define('DISALLOW_FILE_EDIT', true);To make the dashboard always use HTTPS, add:
define('FORCE_SSL_ADMIN', true);If you're locked out or think you've been hacked
- Locked out by a security plugin. In File Manager, rename the plugin's folder in
wp-content/plugins. This turns it off so you can log in. Rename it back afterwards. - Signs of a hack include admin users you didn't create, plugins or files you don't recognise, redirects to other sites and warnings from Google. Change all passwords, restore a clean backup and update everything. Open a ticket if you need help.
Related guides
- How to install WordPress on GHost Cloud
- How to back up and restore your WordPress site
- WordPress troubleshooting: common errors and fixes
- How to install and manage SSL certificates
- How to force HTTPS on your website
WordPress Hosting is R149 a month or R1,499 a year, with automatic WordPress security updates and a staging copy. See WordPress Hosting.
