How to Protect Your WordPress Site from Attacks

To protect WordPress from attacks you need to combine consistent updates, secure server configuration, strong authentication, and a security plugin that acts as a web application firewall. No single measure is enough — real security is a layered system.

This guide covers the most effective measures, ordered from highest to lowest impact, with concrete steps you can apply to your installation today.

1. Keep Everything Updated: the Single Most Impactful Step

The majority of successful hacks exploit known vulnerabilities in outdated versions of WordPress, plugins, or themes. Security fixes are public in changelogs — attackers read them and automate exploits within hours.

• WordPress core: enable automatic minor security updates in wp-config.php: define('WP_AUTO_UPDATE_CORE', 'minor');
• Plugins: enable auto-updates from Plugins > Installed Plugins (the "Auto-updates" column).
• Themes: do the same from Appearance > Themes. Delete unused themes, including default Twenty Twenty-X themes if they're not your active theme.
• PHP: use PHP 8.2 or higher. PHP 7.4 no longer receives security patches.

Golden rule: if a plugin or theme hasn't been updated in over 12 months and has reported vulnerabilities on WPScan, uninstall it.

2. Harden Authentication

Brute-force attacks against /wp-login.php and xmlrpc.php are constant and automated. They're the second most common cause of WordPress hacks.

Strong, unique passwords

Use WordPress's password generator (minimum 20 characters, alphanumeric + symbols). Never reuse passwords across WordPress admin, cPanel, and the associated email account.

Two-factor authentication (2FA)

Install a 2FA plugin like WP 2FA or Two Factor (both free in the official repository). With 2FA active, stealing the password alone isn't enough to gain access.

Limit login attempts

Wordfence, iThemes Security, and Limit Login Attempts Reloaded block IPs after N failed attempts. Configure: maximum 5 attempts, 30-minute lockout, email notification on block.

Block or move wp-login.php

You can rename the login URL with a plugin like WPS Hide Login. This reduces automated bot noise, though it doesn't replace 2FA or login-attempt limiting.

Disable XML-RPC if you don't need it

Add this to your .htaccess if you don't use XML-RPC (Jetpack and some third-party plugins do require it):

<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

3. File Permissions and Server Configuration

Incorrect permissions are a passive backdoor: if an attacker can write to folders they shouldn't be able to, the damage escalates quickly.

Block PHP execution in the uploads folder by adding a .htaccess file inside wp-content/uploads/ with this content:

<Files "*.php">
  Deny from all
</Files>

Also protect wp-config.php directly from the root .htaccess:

<Files wp-config.php>
  Order Allow,Deny
  Deny from all
</Files>

4. Install a Web Application Firewall (WAF)

A WAF filters malicious traffic before it reaches your PHP code. For WordPress there are two main approaches:

Plugin-level WAF (Wordfence, iThemes Security Pro)

Wordfence is the most popular option, and its free version includes:

• A firewall that blocks known exploits.
• A malware scanner that compares your files against originals from the repository.
• Brute-force protection with automatic IP blocking.
• Real-time traffic monitoring.

The premium version adds real-time rule updates (the free version has a 30-day delay) and IP reputation blocking.

External WAF (Cloudflare, Sucuri)

Cloudflare Free provides DDoS protection and some basic WAF rules. The Pro plan ($20/month) enables the full WAF with thousands of rules. This option filters traffic before it reaches your server — a significant advantage over plugin-level solutions.

A managed web security service can configure and maintain your WAF for you, keeping rules up to date and tuned for your specific site.

5. Protect the Database

The database holds all your content and user credentials. These measures reduce the impact of a potential code vulnerability:

• Change the table prefix. The default wp_ is known to every attacker. Changing it to something random (e.g., hx7k_) complicates automated SQL injection attacks. Do this on a fresh installation or with a plugin like iThemes Security.
• Use a database user with minimal privileges. The user WordPress connects with only needs SELECT, INSERT, UPDATE, DELETE — not GRANT, DROP, or ALTER.
• Schedule automatic database backups. Plugins like UpdraftPlus let you schedule daily backups and send them to Google Drive or Dropbox.
• Set WP_DEBUG to false in production. PHP and MySQL error messages should never be exposed to the browser.

6. HTTP Security Headers

HTTP security headers protect your visitors from attacks like XSS and clickjacking at no extra cost. Add them to your .htaccess:

Header always set X-Content-Type-Options "nosniff"
Header always set X-Frame-Options "SAMEORIGIN"
Header always set X-XSS-Protection "1; mode=block"
Header always set Referrer-Policy "strict-origin-when-cross-origin"
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

Check the result at securityheaders.com — aim for an A or A+ grade.

7. Backups and a Recovery Plan

Perfect security doesn't exist: backups are your safety net when everything else fails.

• Schedule automatic daily backups of both files and the database.
• Keep at least 30 days of history.
• Store copies off the same server (Google Drive, S3, Dropbox).
• Test restoration once a month — a backup you've never restored is a backup that doesn't exist.

Find more hardening tips in our web security and SSL section.

Key Takeaways

• Keeping WordPress, plugins, and themes updated eliminates the vast majority of attack vectors.
• 2FA means a stolen password alone is no longer enough to break into the dashboard.
• Correct file permissions and blocking PHP execution in uploads cuts off frequent infection paths.
• A WAF (Wordfence or Cloudflare) filters malicious traffic before it reaches your code.
• Changing the table prefix and limiting database user privileges reduces the blast radius of SQL injection.
• HTTP security headers protect visitors from XSS and clickjacking at zero additional cost.
• Off-server automatic backups are the last line of defense when everything else fails.

If you'd rather have a specialist team configure and maintain your WordPress security, elenlace.com offers maintenance and web security plans with continuous monitoring. Get in touch and we'll harden your site starting today.

FAQ

Is the free version of Wordfence enough to protect my WordPress site?

For most small and medium sites, yes. The free version includes a firewall, malware scanner, and brute-force protection. The main limitation is that firewall rules are delayed 30 days compared to the premium version. If you handle sensitive data or process payments, the premium version or an external WAF like Cloudflare Pro is worth the investment.

Does changing the wp-login.php URL actually improve security?

It reduces noise: automated bots attacking the default URL will stop trying. But a determined attacker can find the new URL, so it doesn't replace 2FA or login-attempt limiting. Use it as a complementary measure, not as primary protection.

Should I use a child theme to avoid losing my changes during updates?

Yes, always. Modifying the parent theme directly means any theme update will overwrite your changes. With a child theme, your customizations are preserved and the parent theme can be safely updated to pick up the developer's security patches.

How often should I review my WordPress security?

Check the updates dashboard weekly. Review your security plugin logs monthly. Run a full scan with Sucuri SiteCheck or the Wordfence scanner every quarter. And test your backup restoration at least once every 30 days.

Compare providers

Other providers and guides worth comparing:

• Hostinger
• HubSpot
• IONOS