- Most hacked sites run outdated software or weak passwords.
- Keep WordPress, themes and plugins updated and delete what you do not use.
- Back up your site and test the restore before you need it.
The Short Answer
Most hacked WordPress sites were not targeted personally. They ran old software, weak passwords or unneeded plugins that bots found automatically. Fix those basics and keep working backups, and you remove most of the risk. If you are still choosing a platform, see our comparison of WordPress and Webflow.
The 12 Steps
1. Update everything. Keep WordPress core, themes and plugins current.
2. Delete what you do not use. Inactive plugins and themes can still be attacked.
3. Use strong, unique passwords and a password manager.
4. Turn on two-factor authentication for every admin account.
5. Do not use “admin” as a username.
6. Limit login attempts with a reputable security plugin or your host's tools.
7. Use HTTPS with a valid certificate.
8. Back up automatically and store copies away from your web server.
9. Install plugins only from trusted sources and avoid pirated themes.
10. Give each person the lowest role they need.
11. Choose good hosting with server-level protection. Our cPanel and managed WordPress guide explains the options.
12. Monitor your site for changes and downtime.
Test Your Backups
A backup only counts if it restores. Try restoring to a test location, and note how long it takes. Keep several dated copies, because a hack may go unnoticed for days.
If Your Site Is Hacked
Do not panic. Put the site in maintenance mode if you can, change every password (hosting, WordPress, database and email), and restore a clean backup from before the hack. Update everything, scan for malicious files and ask your host for help. If you cannot clean it yourself, hire a trusted professional.
Keep It Simple
Security is a habit, not a one-time job. Book a monthly 15-minute check for updates, users, backups and logs.
Action Checklist
- Update WordPress core, themes and plugins
- Delete unused plugins and themes
- Turn on 2FA and use unique passwords
- Limit login attempts and avoid the “admin” username
- Confirm HTTPS works on every page
- Set up automatic off-server backups and test a restore
- Review user roles and remove old accounts
