Guide content
The reality: WordPress is the most attacked CMS
WordPress powers 43% of the world's websites. That makes it the favorite attacker target. Millions of brute force attacks are attempted daily against WordPress sites (Wordfence Threat Report 2024).
Good news: 99% of successful hacks are due to carelessness , not real CMS flaws. A basic security plan prevents almost all.
Minimum WordPress security plan
1. Keep everything updated (most violated rule)
- WordPress core
- All plugins
- All themes
- Server PHP (min 8.1, ideal 8.2+)
Enable auto-updates for security patches from Settings → General.
Don't trust outdated plugins "because they work". A plugin without updates for 12 months is a time bomb.
2. Delete what you don't use
Every hack we clean up has:
- Pre-installed themes never deleted
- Plugins installed "to test" 2 years ago
- wp-config.php backups ( wp-config.php.bak ) publicly accessible
Rule: what you don't use, delete it .
3. Strong passwords and 2FA
- Min 14 random chars for each admin.
- Mandatory 2FA (plugin: Wordfence Login Security free).
- Never use "admin" as username. Create with another name and delete admin if exists.
4. Limit login attempts
Plugin: Limit Login Attempts Reloaded (free). Blocks for 30 min after 5 failed attempts. Stops 95% of brute force attacks.
5. Change table prefix
WordPress installs with wp prefix. Change to random ( abc7 ) during install. Reduces automated SQL injection attacks.
6. Block sensitive files
In .htaccess :
apache
<FilesMatch "(\.bak — \.old — \.tmp — \.sql — wp-config\.php\. — \.user\.ini\.)
quot;Order Allow,Deny Deny from all </FilesMatch
Blocks public access to backups and orphan files.
7. Cloudflare WAF (free)
Free Cloudflare includes WAF blocking SQL injection, XSS, bot attacks, small DDoS. Setup in 10 minutes.
Backup plan that actually works
A backup you haven't tested restoring doesn't exist . Complete plan:
3-2-1 strategy
- 3 copies of your data
- 2 different media
- 1 offsite
Recommended implementation
- Hosting auto-backup (CyberPanel, cPanel) — daily min, weekly kept 4 weeks.
- Cloud backup (Google Drive, Dropbox, S3) with UpdraftPlus or All-in-One WP Migration — weekly.
- Server snapshot if VPS — monthly.
Test restoring every 3 months. Without that test, the backup is theory .
Recommended security plugins
Plugin — Function — Price
Wordfence — Firewall + malware scan + 2FA — Free (Pro $99/yr)
iThemes Security — Complete hardening — Free (Pro $80/yr)
Sucuri — Post-hack cleanup + WAF — $200/yr
WPS Hide Login — Change /wp-login.php URL — Free
Limit Login Attempts Reloaded — Login attempt blocker — Free
Don't install more than 1 firewall plugin at a time (they conflict).
Signs your site was hacked
- Google flags site as unsafe in results.
- Outgoing spam from your hosting (provider warning).
- Posts or admin users you didn't create .
- Strange PHP files in /wp-content/uploads/ (no PHP should be there).
- Slow site for no reason (could be cryptominer).
- Strange redirects from Google to other sites.
If you got hacked
- DON'T panic . Don't delete anything yet.
- Block public access : maintenance mode or change DNS.
- Full snapshot of current state (forensics).
- Change ALL passwords : WP admin, hosting, FTP, DB.
- Use scanner like Wordfence to identify infected files.
- Restore from last clean backup (not most recent which is already infected).
- Update everything to latest .
- Ask Google to re-review from Search Console.
Without experience, hire pro help: bad cleanup leaves orphan droppers that reactivate weeks later.
Conclusion
WordPress security isn't paranoia: it's basic hygiene . Regular updates, strong passwords, 2FA, tested backups and a firewall (free Cloudflare) make your site safer than 95% of WordPress online.
At DATXALE we include complete hardening + daily auto-backups in all web packages. Chat on WhatsApp.