WordPress security mostly comes down to five habits: keep WordPress, plugins, themes and PHP up to date; protect every login with a strong password and two-factor authentication; put a firewall in front of the site; take daily backups stored away from the server; and monitor for changes so you know quickly when something’s wrong. Most hacked WordPress sites aren’t targeted by anyone in particular. They’re found by automated scans looking for a known weakness, usually an out-of-date plugin.
That’s reassuring, in a way. If attacks are mostly automated, the basics stop most of them. This guide covers those basics, how to spot a site that’s already been compromised, and what to do first if yours has.
Is WordPress secure for business websites?
Yes, when it’s maintained. WordPress core is actively developed and security issues in it are fixed quickly. The weak points are the plugins and themes added on top, the passwords people choose, and hosting that isn’t kept up to date.
WordPress powers a large share of the web, which makes it a common target. Attackers write tools that scan thousands of sites for one vulnerable plugin version, then break into every site that has it. A site that applies security updates promptly simply isn’t on the list.
How do I stop my WordPress site being hacked?
Picture how a typical break-in happens. Say you run a recruitment agency and your site uses a forms plugin for CV uploads. On a Tuesday, a security flaw in that plugin is made public, along with a fixed version. By the weekend, automated scanners are trying the flaw on every site they can find. If your site updated on Wednesday, nothing happens. If nobody has logged in since the summer, someone now has a way in.
Every step below is about closing a door like that one.
Keep everything updated
Update plugins, themes and WordPress core promptly, and treat security releases as urgent. Check your PHP version too: older versions stop receiving security fixes. Delete plugins and themes you no longer use, because deactivated code can still be attacked. Test larger updates on a staging copy first so a fix doesn’t break the site. Our WordPress maintenance checklist sets out a weekly and monthly routine for this.
Lock down logins
- Give every person their own account. No shared “admin” login.
- Use long, unique passwords, stored in a password manager.
- Turn on two-factor authentication for every account that can publish or change settings.
- Limit failed login attempts, so bots can’t keep guessing.
- Give people the lowest role that lets them do their job. Someone who writes blog posts needs Editor or Author access, and nobody needs Administrator just to publish.
- Remove accounts when people leave.
Put a firewall in front of the site
A web application firewall (WAF) filters traffic before it reaches WordPress, blocking known attack patterns, malicious bots and floods of requests. It can be provided by your host, by a service like Cloudflare, or by a security plugin. A firewall at the network level stops bad traffic before your server has to process it.
Use HTTPS everywhere
HTTPS encrypts what passes between the visitor’s browser and your site, so form submissions and login details can’t be read in transit. Browsers now label non-HTTPS pages as “not secure”, which puts people off filling in your forms. Most hosts provide free SSL certificates; make sure every page redirects to the HTTPS version.
Be careful with file uploads
Any form that accepts uploads, such as CVs, photos or documents, is a potential way in. A file disguised as an image can carry code that opens a back door to be used later. If you need uploads, allow only the file types you expect, limit file size, store uploads where they can’t be run as code, and keep the plugin handling them up to date.
Back up daily, off the server
Backups don’t stop an attack, but they decide how bad it gets. Keep daily backups of files and the database, stored separately from the hosting, with enough history to go back several weeks. Some infections sit unnoticed for a while, so the most recent backup may already be affected.
Most WordPress attacks are automated scans for one known weakness. Keep up with updates and the scans pass you by.
What are the signs a WordPress site has been hacked?
Some are obvious. Others are designed to go unnoticed for as long as possible. Watch for:
- Google showing “This site may be hacked” under your listing, or a warning in the Security Issues report in Search Console.
- Visitors on mobile, or arriving from Google, being redirected to spam or scam sites (often while the site looks normal when you visit directly).
- Pages you didn’t create appearing in Google. Search for “site:yourdomain.co.uk” and look for spam terms or foreign-language pages.
- Administrator accounts you don’t recognise.
- New or modified files you didn’t change, which a security scanner will flag.
- Your host suspending the site, or your emails suddenly landing in spam because your server has been sending it.
- The site becoming unusually slow, which can mean it’s being used to attack other sites.
What should I do if my website is hacked?
Act quickly, and in this order:
- Don’t delete everything in a panic. Take a copy of the site in its current state first. It shows how the attacker got in, which you need to know to stop them coming back.
- Restore from a clean backup taken before the compromise, if you have one. If you’re not sure when it happened, a professional clean-up may be safer than guessing.
- Change every password: WordPress users, hosting, database, FTP or SFTP, and email accounts on the same domain. Reset the security keys in WordPress too, which logs everyone out.
- Close the hole. Update everything, remove the vulnerable plugin if there’s no fix, and delete any unknown admin accounts.
- Scan again to confirm the site is clean.
- If Google flagged the site, fix the issue and then request a review in Search Console so the warning is removed.
If customer data could have been accessed, take advice on whether you need to report it. Under UK GDPR, some personal data breaches must be reported to the Information Commissioner’s Office within 72 hours.
How we keep WordPress sites secure
We host 200+ WordPress sites on infrastructure built with security in layers: Kinsta’s managed hosting on Google Cloud, Cloudflare’s firewall and DDoS protection in front, continuous vulnerability scanning, daily malware scans and backups with rapid restore options. Updates are tested and applied on a fixed weekly and monthly routine by our in-house WordPress developers. If you’d like that handled for you, have a look at our WordPress care plans.
FAQs
Do I need a security plugin for WordPress?
A security plugin helps, particularly for login protection and file scanning, but it isn’t enough on its own. Updates, strong logins with two-factor authentication, a firewall and off-site backups matter more. If your host already provides a firewall and malware scanning, a lighter plugin focused on logins may be all you need.
How do hackers get into WordPress sites?
Most break-ins use a known vulnerability in an out-of-date plugin or theme, or a weak or reused password. Attacks are usually automated: bots scan large numbers of sites for a specific weakness and exploit every one they find. Prompt updates and two-factor authentication stop the majority of these attempts.
Can a hacked WordPress site be fully cleaned?
Usually, yes. The site is restored from a clean backup or cleaned file by file, the vulnerability that let the attacker in is fixed, and every password and security key is changed. The step people skip is finding the way in, and without it the site is often reinfected within days.
Will a hacked website affect my Google rankings?
It can. Google may show a warning in search results, which sharply reduces clicks, and spam pages added by attackers can damage how Google sees your site. Once the site is cleaned and you request a review in Search Console, warnings are normally removed and rankings tend to recover.
