Securing WordPress: what actually matters

Most hacked WordPress sites are not hit by a targeted attack but by an automated scanner exploiting a known vulnerability.

Keep it updated

Core, themes and plugins. An outdated plugin is the most common way in. Delete what you do not use instead of deactivating it — deactivated code is still there.

Limit logins

A maximum number of attempts and two-factor authentication for administrators. That alone removes the vast majority of automated attempts.

Fewer administrators

Give everybody the minimum role they need. An editor does not need to be able to install plugins.

Back up elsewhere

A backup on the same server disappears with it. That is not prevention, but it decides how bad an incident becomes.

Monitor changes

A notification when files change unexpectedly warns you far sooner than a visitor reporting a problem.