How to secure WordPress

This guide covers the practical steps that protect a WordPress site from being hacked, and what we already do on the server.

What’s already in place

Every account is protected by Imunify360, which includes a firewall and malware scanning. We also back up your account every six hours with JetBackup. These help, but most break-ins happen through weak passwords or out of date plugins, so the steps below still matter.

Apply WP Toolkit security measures

1. Log in to cPanel and click WP Toolkit.
2. Find your site and click Security. On some versions this is a shield icon, and the wording varies.
3. WP Toolkit lists hardening measures, such as blocking access to sensitive files and turning off file editing in the dashboard.
4. Tick the recommended measures and click Secure.
5. Visit your site and check it still works. If something breaks, go back and click Revert on the measure you last applied.

The full set of measures is part of WP Toolkit Deluxe on our WordPress plans.

Use strong passwords and two-factor login

• Give every admin user a long, unique password. A password manager makes this easy.
• Don’t use “admin” as a username.
• Install a two-factor authentication plugin from Plugins, then Add New Plugin. This asks for a code from an app on your phone as well as your password.
• Go to Users and remove accounts that no longer need access. Give people the lowest role that lets them do their job, for example Editor rather than Administrator.

Keep things updated and tidy

1. Update WordPress, themes and plugins regularly. See how to update WordPress, themes and plugins.
2. Go to Plugins and delete any you aren’t using. Deactivated plugins can still be attacked if their files are on the server.
3. Go to Appearance, then Themes, and delete themes you don’t use. Keep one default WordPress theme as a fallback.
4. Only install plugins and themes from the WordPress directory or from developers you trust. Avoid “free” copies of paid plugins.

Use https

Install a free certificate so logins and form data are encrypted. See how to install a free SSL certificate, then change your site address to https.

If it doesn’t work

• A security measure breaks part of the site. Revert that measure in WP Toolkit.
• You get locked out by the two-factor plugin. Rename that plugin’s folder in File Manager to turn it off, log in, then set it up again.
• You think the site has been hacked. See how to scan your site for malware and consider restoring a clean backup.

Good to know

Backups are your safety net. Learn how to restore one before you need it. See how to restore a backup with JetBackup.

Still stuck? Open a support ticket and we’ll help.