The good news: most WordPress hacks aren't sophisticated. They're automated bots looking for the same handful of weaknesses across millions of sites. Close those weaknesses and you stop being interesting to the bots. This is the 10-step list we run on every site we onboard.
1. Force HTTPS everywhere
Your host probably gives you a free Let's Encrypt cert. Turn it on and add a permanent redirect from http:// to https://. Mixed content warnings hurt both trust and SEO.
2. Replace the admin username "admin"
Half of brute-force attempts try admin as the username before anything else. If your account is still called admin, create a new admin user, log in as that one, then delete the old account and reassign its posts.
3. Enforce strong passwords and 2FA on every admin
Use a password manager. Turn on two-factor for every user with an editor role or higher. Plugins like Wordfence and miniOrange both do this well.
4. Limit login attempts and rename the login URL
Brute-force protection blocks an IP after N failed attempts. Renaming /wp-admin to a custom path stops 90% of automated scanners from finding the login screen at all.
5. Keep core, themes, and plugins updated
The #1 cause of compromised WordPress sites is an outdated plugin with a known vulnerability. Turn on automatic updates for minor releases. For major updates, test on staging first.
6. Remove plugins and themes you aren't using
Even deactivated plugins live in your filesystem and can be exploited if their files are reachable. Delete what you don't need.
7. Disable file editing from the admin UI
Add this to wp-config.php:
define( 'DISALLOW_FILE_EDIT', true );This stops an attacker who compromises an admin account from editing PHP files inside WordPress.
8. Lock down wp-config.php and .htaccess
These files contain your database credentials and server rules. Their permissions should be 600 or 640, never 777. Most managed hosts handle this for you.
9. Run a Web Application Firewall (WAF)
A WAF (Cloudflare, Sucuri, or your host's built-in) blocks malicious requests before they reach WordPress. This is the single highest-impact thing on this list — it stops vulnerabilities you don't even know you have.
10. Take backups you have actually tested
Backups you've never restored aren't backups, they're hope. Take daily off-site backups (UpdraftPlus or your host's built-in) and restore one to a staging site every quarter to confirm it works.
The honest part
You can do all ten yourself — the steps aren't hard. But maintaining them across plugin updates, host migrations, and a year of staff turnover is where most sites quietly slip back to insecure defaults. That's what we handle. Set it up once, audit it every month.