How to Defend WordPress from Attacks: 8 Best Practices

WordPress powers a huge share of the web, which makes it a constant target. The good news: the overwhelming majority of compromised sites are not victims of exotic zero-day exploits. They fall to predictable, preventable weaknesses — outdated software, weak passwords, over-privileged accounts, and abandoned plugins. Close those gaps and you remove most of the risk. Defense in depth is the goal: no single control is perfect, but layered together they make your site far more trouble than it is worth to an attacker. Here are eight best practices that turn a soft target into a hardened one.

1. Keep everything updated

Outdated code is the single most common entry point into a WordPress site. Vulnerabilities in core, plugins, and themes are publicly disclosed, and automated bots begin scanning for unpatched installs within hours of a disclosure. Enable automatic updates for minor core releases and for plugins you trust, and review major updates promptly on a staging copy before they hit production. Treat an unmaintained plugin — one that has not seen an update in over a year — as a liability and replace it.

2. Lock down the login

Brute-force and credential-stuffing attacks hammer wp-login.php around the clock. Require strong, unique passwords for every account and use a password manager so no credential is reused across sites. Enable two-factor authentication (2FA) for administrators, and limit failed login attempts so repeated guesses get throttled or blocked. Where possible, restrict admin access by IP address, and never use the default admin username.

3. Apply least privilege

Give each user the lowest role that lets them do their job. A contributor who only writes posts should never hold administrator rights. The fewer accounts that can install plugins, edit files, or manage users, the smaller your blast radius if one account is phished or guessed. Audit your user list regularly and remove accounts that are no longer needed.

4. Reduce your attack surface

Every plugin and theme is code that runs on your server — even when deactivated, the files remain on disk and can be exploited. Delete anything you are not actively using, and install only from reputable sources such as the official WordPress repository or established commercial vendors. Avoid “nulled” (pirated) plugins entirely; they are a notorious vehicle for hidden backdoors that activate long after installation.

5. Harden the WordPress install

A few configuration changes raise the bar significantly. Disable the built-in file editor by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php, so an attacker who reaches the dashboard cannot edit PHP directly. Set correct file permissions (typically 644 for files and 755 for directories), protect wp-config.php, block PHP execution in the uploads directory, and disable XML-RPC if you do not use it. Always serve the entire site over HTTPS.

6. Put a firewall in front of your site

A web application firewall (WAF) filters malicious traffic before it ever reaches WordPress, blocking common SQL injection, cross-site scripting, and known-exploit patterns. It is your first line of defense and buys you crucial time when a new vulnerability is disclosed but your site is not yet patched — a window attackers race to exploit at scale.

7. Monitor file integrity

Most successful intrusions leave evidence: a new administrator you did not create, a modified core file, an unfamiliar PHP file in wp-content/uploads, or a scheduled task that quietly re-creates a backdoor. File-integrity monitoring records a clean baseline of your site and alerts you the moment something changes unexpectedly. Verifying WordPress core checksums against the official release is a fast way to spot tampering. Catching a web shell early is the difference between a five-minute cleanup and a full-blown breach.

8. Back up — and test your restores

Backups are your safety net for everything from a botched update to a ransomware-style defacement. Keep automated, regular backups stored off-site — not just on the same server an attacker may already control — and, crucially, periodically test that you can actually restore from them. A backup you have never restored is only a hope, not a plan.

If you are already compromised

Act methodically. Take the site into maintenance mode to stop the spread and protect visitors. Scan the full filesystem and database for malware and web shells, then remove them. Rotate every credential — WordPress users, database, hosting, FTP/SFTP, and any API keys. Reinstall WordPress core and all plugins and themes from known-good sources, and verify core checksums before bringing the site back online. Finally, review your access logs to understand how the attacker got in, and close that specific gap so it cannot be reused.

Security is not a one-time task but an ongoing habit. Layer these practices, automate what you can, and monitor continuously — and your WordPress site will stay resilient against the attacks that take down everyone who skips the basics.