WordPress Security Basics Every Site Needs

Across this course, we've mentioned security risks in passing: random plugin ZIP files, too many Administrator accounts, outdated themes. This lesson pulls those threads together into a proper security checklist, and explains the reasoning behind each item.

Keep Everything Updated

Start with the single most important habit: keep everything updated. WordPress core, your theme, and every plugin regularly receive security patches, often silently fixing vulnerabilities that attackers actively scan the internet for. A huge share of hacked WordPress sites were running outdated software with a publicly known, already-patched vulnerability. Updating promptly isn't optional polish; it's the single biggest thing you control.

Passwords, Accounts, And Logins

Next, passwords and accounts. We covered roles in an earlier lesson: give each user the minimum role they need, not Administrator by default. On top of that, use genuinely strong, unique passwords for every account, especially Administrator accounts, and enable two-factor authentication if a security plugin or your host offers it. WordPress's default login page is at a predictable address (yoursite.com/wp-login.php), which means automated attacks constantly try common username and password combinations against it; a weak "admin / password123" combination is essentially an open door.

A closely related tip: never use "admin" as an actual username. It's the first guess every automated attack tries. Choose something less predictable for your Administrator account's username specifically.

Limiting login attempts is another practical layer: many security plugins can lock out an IP address after a handful of failed login attempts within a short window, which defeats the "try thousands of password combinations automatically" style of attack almost entirely.

File permissions and wp-config.php deserve mention too, tying back to the installation lesson. That file holds your database credentials and special security "salt" keys; it should never be publicly readable or editable by anyone other than your server process. Most hosts configure this correctly by default, but if you're managing your own server, it's worth explicitly confirming.

Backups Are A Security Measure

Backups are a security measure, not just a convenience. If something does go wrong, a hack, a bad plugin update, an accidental deletion, a recent, working backup (both the database and the files) is what actually gets you back online quickly. A security setup with no backups is incomplete; it only prevents problems; it doesn't give you a fast way to recover from the ones it misses.

A web application firewall, often bundled into a popular security plugin, filters out obviously malicious requests before they ever reach WordPress's own code: known attack patterns, suspicious file upload attempts, and so on. This is a useful extra layer, though it's not a substitute for the updates and strong passwords above; think of it as reducing exposure, not eliminating the need for the basics.

Securing The wp-config Keys

Here's a small, often-overlooked example: the default wp-config.php contains a block of "secret keys" used to secure cookies and sessions.

define( 'AUTH_KEY',         'put your unique phrase here' );
define( 'SECURE_AUTH_KEY',  'put your unique phrase here' );
define( 'LOGGED_IN_KEY',    'put your unique phrase here' );
define( 'NONCE_KEY',        'put your unique phrase here' );

If these are ever left as the literal placeholder text instead of being replaced with real random values (WordPress's official secret-key generator tool provides these), your site's session security is meaningfully weaker. Most modern installers replace these automatically, but it's worth checking an old or manually-set-up install.

Security Is Ongoing, Not One-Time

A mistake beginners make: treating security as a one-time setup task, installing a security plugin once and never checking in again. Real security is ongoing: checking for updates regularly, periodically reviewing which users and plugins are active (tying back to the plugins and users lessons), and paying attention if a security plugin flags unusual activity rather than dismissing the notification.

It's also worth remembering that comments, mentioned briefly in the dashboard lesson, are a common, low-effort attack surface. Spam comments can carry malicious links, and a comment form left wide open to anonymous submissions on an otherwise locked-down business site, like Tony Stark Consulting's, is often an unnecessary risk for a site that doesn't need public comments in the first place. Disabling comments entirely, or requiring approval before anything goes live, closes off this surface with almost no downside for a site that isn't primarily a community-driven blog.

Finally, keep an eye on who has FTP, hosting panel, or SSH access to the server itself, not just WordPress dashboard access. A perfectly locked-down WordPress install can still be compromised through a weak hosting account password, since that level of access can bypass WordPress's own login screen entirely and reach the files and database directly. Security is a chain across several layers, hosting account, server, WordPress accounts, plugins, and a weak link at any one layer can undermine careful work done at all the others.

Try This Now

Worth trying right now: right now, check whether your WordPress core, theme, and plugins all show "up to date" in your dashboard, confirm no account uses "admin" as its username, and confirm you have at least one working backup method in place, even a basic manual one, before moving on.