WordPress powers a huge portion of the web. That popularity makes it a target. The good news is that most successful attacks still rely on the same handful of preventable mistakes.
Here’s what I recommend every WordPress site owner get right.
1. Keep Everything Updated
Core, themes, and plugins. Enable automatic updates for minor releases of WordPress itself and for any plugins you trust. Outdated software is still the number-one way sites get compromised.
2. Strong Authentication
- Use unique, long passwords (or better, a password manager).
- Enable two-factor authentication on every administrator account.
- Limit login attempts. A simple plugin or server-level rule stops most brute-force noise.
3. Principle of Least Privilege
Not every user needs an Administrator role. Give people the lowest level of access that still lets them do their job. Review user accounts regularly and remove ones that are no longer needed.
4. File and Directory Permissions
On most hosts the correct settings are:
- Directories: 755
- Files: 644
- wp-config.php: 600 or 640
Never leave directories world-writable.
5. Security Headers and Hardening
A few small changes make a measurable difference:
- Disable file editing in the dashboard (DISALLOW_FILE_EDIT)
- Limit access to wp-admin and xmlrpc.php if you don’t need them
- Add basic security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy, etc.)
6. Backups You Can Actually Restore
Daily (or real-time) off-site backups are non-negotiable. Test a restore at least once a quarter so you know the process works when you need it.
7. Choose Quality Over Quantity with Plugins
Every plugin is another potential attack surface. Prefer well-maintained plugins with recent updates and a solid track record. Remove anything you’re not actively using.
Security is not a one-time project. It is a set of habits. Get the basics solid and you eliminate the vast majority of common threats.
If you’re running WordPress and want a second set of eyes on your setup, feel free to reach out.