Skip to content
Spin up a fresh WordPress install, leave it untouched for a week, and check the logs. Hundreds of login attempts you never made. Bots probing wp-login.php, xmlrpc.php, and a handful of plugin paths you’ve never heard of. None of it personal. All of it automated, all the time.
That’s the baseline. Now picture your real site sitting in the middle of it, and ask whether keeping things updated is going to be enough.
It isn’t. Updates patch holes someone already found and reported. They do nothing about a recycled password, a plugin you installed in 2019 and never touched again, or the fact that wp-login.php happily takes ten thousand guesses a night. Keep updating. Of course. Then keep reading, because there’s plenty more.
Why WordPress catches so much heat
W3Techs puts WordPress at around 42% of the entire web as of mid 2026. Single biggest CMS by a long way. If you’re writing attack automation, you write it for WordPress first, because WordPress is where the volume is.
The other half is openness. The code is public, which is mostly a strength: thousands of developers improve it and surface bugs. But the same code is open to the people looking for ways in. Find a flaw in a plugin with two million installs and you’ve just found a flaw in two million sites overnight. That’s why “popular plugin discloses vulnerability” is the lead in security news most weeks.
None of this is a reason to leave the platform. It just means you’re playing on a noisy field. Most of the traffic hitting your login page right now is a script, not a person, and the same handful of changes stops the vast majority of them.
The login page
Long, unique password on every account, stored in a manager like Bitwarden or 1Password. Never recycle one from anywhere else. That alone shuts down credential stuffing, where attackers try passwords leaked from other breaches against your site.
Then two factor authentication, usually a six digit code from an app on your phone. WordPress doesn’t ship with it; a plugin like Wordfence or a built-in option from your host adds it. Turn it on for every admin, no exceptions.
Limit login attempts too. Out of the box, WordPress lets a bot guess forever. Limit Login Attempts Reloaded and most security plugins cap it (five tries then a lockout works fine), and many hosts handle it at the server level so the bot never reaches PHP at all.
One more: roles. WordPress has five built in (Administrator down to Subscriber) and most teams hand out Administrator out of habit. Your blog writer is an Editor. Your designer is probably an Editor too. The fewer people who can install plugins or touch code, the smaller your blast radius when one account gets popped.
Be ruthless with plugins and themes
A flaw in any plugin you have installed is a flaw in your site, full stop. So:
- Install from the WordPress.org repository or a developer you’d actually pay for, never from a site offering nulled or “free” copies of premium products. Those are how backdoors get in.
- Check the last update date and the active install count. Anything dormant for two years is a risk, no matter how well it worked once.
- If you stopped using it, delete it. Deactivated isn’t gone. The code is still on your server, still loadable, still exploitable when the right bug ships.
A tidy site has maybe a dozen well-chosen plugins. A messy one has forty, half of them forgotten. Audit yours twice a year.
Closing the doors you don't use
Hardening is a fancy word for shutting things off. Three targets are worth your time.
The dashboard's built-in file editor lets any administrator rewrite theme and plugin code straight from the browser. Handy for you. A gift for an attacker who just stole an admin account. Addingdefine('DISALLOW_FILE_EDIT', true);towp-config.phpremoves it, and most security plugins offer it as a single toggle.
File permissions decide who can read or change each file on your server. Set them too loose and you’ve handed write access to whoever turns up. A safe baseline:
Your host usually has sensible defaults. If yours doesn’t, that’s a conversation to have.
SSL isn’t optional any more. The padlock in the address bar means traffic between visitors and your server is encrypted, browsers stop showing scary warnings, and Google nudges you up the rankings for having it. Our guide on getting an SSL for a safer online business lays out the case in full.
Last, security headers. Tiny invisible HTTP instructions like HSTS, X-Frame-Options, and Content-Security-Policy that tell browsers how to behave around your site, blocking clickjacking and a stack of injection tricks. SecurityHeaders.com will grade what you’re sending right now in about ten seconds.
A firewall, and someone watching the files
A web application firewall (WAF) sits between the internet and your site. Cloudflare’s, Sucuri’s, and Wordfence’s all do the same job: drop bad requests before they reach WordPress. SQL injection attempts, known exploit patterns, traffic from IPs that have already misbehaved elsewhere on the network.
Malware scanning is the other half. Something checks your files on a schedule, flags anything that shouldn’t be there, and tells you fast if a site you trusted on Monday is serving credit card skimmers by Thursday.
A firewall, and someone watching the files
Assume something will go wrong one day. A recent backup is the difference between a bad afternoon and starting over. Automatic. Stored off the same server. Tried at least once so you know the restore actually works. For how often to run them, our post on how often you should back up your website is a sensible starting point.
What we handle on our side
Plenty of WordPress security isn’t yours to manage. The server underneath, the network in front of it, the patching of PHP and Linux and MySQL, the isolation between accounts, the intrusion detection. All host territory.
A managed plan adds the application layer on top. Free SSL, daily backups, malware scanning, and a real person to talk to when something looks off. Our support team handles malware detection and removal as part of the service, which is the thing you actually want at two in the morning.
If wrestling with all this isn’t how you’d rather spend Tuesday, managed WordPress hosting bundles most of it together from the day you sign up.
Your end-of-post checklist
- Core, plugins, themes all current
- Unique password on every account, 2FA on every admin
- Login attempts capped with lockouts
- Each user on the smallest role they need
- Plugins and themes from trusted sources, unused ones deleted
- File editor disabled in the dashboard
- Permissions sensible, wp-config.php at 600
- SSL on, security headers sending
- WAF and malware scanning running
- Backups automatic, off-site, restored in the last 90 days
Tick most of those and you’re well past where updates alone were doing the work.