How to secure (harden) your WordPress site

WordPress is safe when looked after. These steps dramatically reduce the risk of being hacked.

The essentials

  • Keep everything updated — core, themes and plugins.
  • Use a strong admin password and avoid the username admin.
  • Install a security plugin like Wordfence for a firewall and login protection.
  • Limit login attempts and consider two-factor authentication.

Extra hardening

  • Make sure your site uses https (free SSL is included).
  • Remove themes and plugins you don't use.
  • Only install plugins and themes from trusted sources.
  • Take regular backups so you can recover fast.

Think you've been hacked?

Change all passwords, take the site offline if needed, and open a ticket — we can help you clean up and restore from a clean backup.

Was this answer helpful?

 Print this Article

Also Read

How to install WordPress

WordPress is the most popular way to build a website, and you can install it in a few clicks with...

How to log in to your WordPress dashboard

The WordPress dashboard (wp-admin) is where you manage your site — pages, posts, themes, plugins...

How to reset your WordPress admin password

Locked out of WordPress? Use WordPress's own email reset first. If that email cannot reach you,...

How to keep WordPress updated

Keeping WordPress, your theme and plugins up to date is the single most important thing you can...

How to install a WordPress theme

Your theme controls how your site looks. Install thousands of free themes — or upload one you...