crackthe.net
How to secure WordPress: the first ten steps
Ten steps that protect a WordPress site against most attacks: updates, fewer plugins, strong logins, two-factor sign-in, PHP, and backups.
Key points
- Most attacks on WordPress use known flaws in plugins or guess passwords. Updates and strong logins stop most of them.
- WordPress does not include two-factor sign-in. A free plugin by the WordPress community adds it.
- Keep backups of the files and the database, in more than one place.
Before you start
You need an administrator account in WordPress and, for step 8, access to the file wp-config.php through SFTP or your host’s file manager. Make a backup first (step 10), then work through the list. The steps follow WordPress’s official hardening guide and its page on login attacks.
The ten steps
- Turn on automatic updates. WordPress installs its own security releases automatically. For plugins and themes, click “Enable auto-updates” next to each one in the list of plugins and themes.
- Delete plugins and themes you do not use. A deactivated plugin is still on the server. Keep one default theme as a fallback.
- Use a long, unique password for every account. The WordPress guide warns against your own name, the user name, the site name, single words from a dictionary, and short passwords. A password manager makes this easy.
- Turn on two-factor sign-in for every administrator. WordPress core does not include it. The free plugin Two Factor, developed by the WordPress community, adds codes from an authenticator app, codes by email, and backup codes.
- Do not use “admin” or “webmaster” as a user name. They are easy to guess.
- Give each person the lowest role that fits their work. Someone who writes posts does not need to be an administrator.
- Limit login attempts. The WordPress guide recommends limiting them at a firewall or on the web server. Many security plugins can do it too.
- Turn off the file editor in the dashboard. Add
define( 'DISALLOW_FILE_EDIT', true );to wp-config.php. According to WordPress, this does not stop all attacks, but it can stop some. - Run a supported PHP version. WordPress recommends PHP 8.3 or newer. PHP 8.2 gets security fixes only until December 31, 2026. Your host updates PHP, often at your request.
- Make backups of the files and the database. WordPress advises weekly backups for small sites, daily ones for busy sites, and 3 to 5 recent copies in different places.
What these steps do not cover
They protect your WordPress installation. Flaws in the server software, such as PHP itself, are fixed by your host. A firewall in front of the site can block attacks before a fix exists. The guide Why do WordPress sites get hacked? explains how fast attacks follow when a flaw becomes public.
Next step
The page Web security tools lists security plugins, backup plugins, and firewalls with their figures from WordPress.org.
The figures in this guide come from the archive and change with every data update. As of November 13, 2026.