The short answer: Most hacked WordPress websites are not attacked by clever geniuses. They are broken into through easy doors: old software, weak passwords, unreliable plugins and themes, and pirated downloads. You can close most of these doors in a day. Keep WordPress, plugins and themes updated, use strong unique passwords and two-step login, install only trusted plugins and themes, make backups you have tested, use HTTPS and good hosting, and watch for warning signs.
Your website is working, customers are finding you and then one day you open it and see a strange page, a warning from Google or a flood of spam links. Or it simply redirects visitors to a website selling something you have never heard of.
This happens to thousands of small business websites, and WordPress sites are common targets, because WordPress is used so widely. It does not mean WordPress is a bad choice. It means that any popular website system needs care, as I explain in WordPress or Custom PHP: Which Is Right for Your Business Website?.
This article gives you 10 simple steps to make your site much harder to hack, and explains what to do if you think it has been hacked. You do not need to be a security expert.
How Do WordPress Sites Get Hacked?
Hackers use automated tools that scan the internet for weak sites. They are not interested in you personally. They look for easy openings:
- Old versions of WordPress, plugins or themes with known security holes
- Weak or reused passwords, or the username "admin"
- Unreliable plugins and themes, especially pirated ones that contain hidden malware
- Poor hosting where other websites on the same server are infected
- Stolen passwords from your computer, a hacked email account or a shared device
Once inside, they may send spam, add hidden links to improve their own websites, steal customer data, redirect your visitors or use your server to attack others.
The 10 Steps
1. Keep Everything Updated
Updates often fix security holes. WordPress installs minor security updates automatically, but you must still check for major versions, plugins and themes.
- Log in at least once a week and check for updates.
- Update WordPress, plugins and themes, and delete anything you do not use.
- Before a major update, make a backup.
- If a plugin or theme has not been updated for a long time, replace it.
2. Use Strong, Unique Passwords
- Every account (WordPress, hosting, email, domain, database) needs its own long password.
- Mix letters, numbers and symbols, or use a long phrase. Avoid names, birthdays and phone numbers.
- Never reuse the same password on different sites.
- A password manager can create and remember strong passwords for you.
3. Do Not Use "admin" and Limit Login Attempts
Hackers try the username "admin" first. Create a new administrator account with a different username, and delete the old one. Also limit failed logins, so that a robot cannot try thousands of passwords. A plugin such as Limit Login Attempts, or the login protection in a security plugin, can do this.
4. Turn On Two-Step Login
Two-step (or two-factor) login asks for a code from your phone as well as your password. Even if a password is stolen, the hacker cannot get in. Plugins such as Google Authenticator for WordPress add this to your login. It is also worth using for your email account, as I explain in Business Email on Your Own Domain: Why name@yourcompany.com Matters.
5. Install Only Trusted Plugins and Themes
- Download from the official WordPress directory or from the author or a reputable marketplace.
- Look at the number of installs, the reviews and the date of the last update.
- Install only what you need. Each extra plugin is another possible hole.
- Never use pirated or "nulled" themes and plugins. They are paid products shared illegally, and they very often contain hidden backdoors or malware.
- Delete deactivated plugins and themes you do not use. Deactivating is not enough.
6. Make Regular Backups, and Test Them
A backup is your safety net. If your site is hacked or broken, a clean copy lets you recover quickly.
- Back up both your files and your database.
- Back up automatically, daily or weekly depending on how often your site changes.
- Store copies away from your server, such as in cloud storage or on your own computer, because a backup on the hacked server may be lost too.
- Plugins such as UpdraftPlus can do this for you.
- Test your backup by restoring it, at least once. A backup you cannot restore is not a backup.
7. Use HTTPS
HTTPS protects the information that passes between your visitors, you and your website, including your own login. Make sure the login page and the whole site use it. I explain how in Why Every Website Should Move to HTTPS.
8. Choose Good Hosting and Set Safe Permissions
Your hosting is the foundation. A good host keeps its software updated, isolates accounts, offers backups and responds quickly. I cover what to ask in How to Choose a Domain Name and Web Hosting Without Getting Cheated. Ask also that your files have safe permissions, so that others cannot change them. Your developer or host can set this.
9. Turn Off File Editing in the Dashboard
By default, an administrator can edit theme and plugin files from inside WordPress. If someone gets in, they can plant code there. You can switch this off by adding a single line to your wp-config.php file: define('DISALLOW_FILE_EDIT', true);. Ask your developer to do this if you are not sure.
10. Add Protection and Watch for Warnings
- Use a well-known security plugin or service, such as Wordfence, Sucuri or iThemes Security. They can scan for malware, block attacks and alert you to changes.
- Give other people only the access they need. A writer does not need to be an administrator.
- Register your site with Google Search Console. Google can warn you there if it finds a security problem.
- Remove users who no longer work with you.
Signs That Your Site May Be Hacked
- Strange pages, adverts or links that you did not add
- Visitors being redirected to another website
- A warning in Google results or in a browser, saying the site may be hacked or unsafe
- New administrator accounts that you do not recognise
- Your site suddenly slow or down
- Your hosting company contacting you about spam or unusual activity
- Search results showing odd titles or text for your pages
What to Do If Your Site Is Hacked
- Stay calm, and do not ignore it. Hacked sites get worse the longer they are left.
- Contact your hosting company. They may help find and clean the problem, and they can tell you what they see on the server.
- Change all your passwords for WordPress, hosting, database and email, using a clean, safe computer.
- Restore a clean backup if you have one made before the hack.
- Update everything and remove unknown users, plugins and themes.
- Scan for malware with a security plugin or service, or ask a professional to clean the site.
- Find out how they got in, otherwise it will happen again.
- Tell Google. If Google has flagged your site, use Search Console to request a review after the site is clean.
- Tell your customers if their data may have been exposed, and follow any legal duties.
If you are not sure how to clean the site, ask a professional. A badly cleaned site is often hacked again.
Common Mistakes
- Never updating WordPress, plugins or themes
- Using the same password everywhere
- Keeping the username "admin"
- Using pirated themes and plugins
- Keeping lots of unused plugins installed
- Keeping backups only on the same server
- Never testing a backup
- Giving every user administrator access
- Ignoring warnings from Google or your host
A Quick WordPress Security Checklist
- WordPress, plugins and themes are up to date
- Unused plugins and themes are deleted
- Every account has a strong, unique password
- The username "admin" is not used, and login attempts are limited
- Two-step login is turned on
- Plugins and themes come from trusted sources only
- Automatic backups are stored away from the server, and I tested a restore
- The site uses HTTPS
- My hosting is reliable and well maintained
- File editing in the dashboard is switched off
- A security plugin is installed, and Google Search Console is set up
Frequently Asked Questions
Is WordPress insecure?
WordPress itself is regularly updated and is reasonably secure. Most problems come from outdated plugins and themes, weak passwords, pirated software and poor hosting. Looked after properly, a WordPress site can be very safe.
Do small websites get hacked?
Yes. Hackers use automated tools that attack thousands of sites, so a small business website is as likely a target as a large one.
Do I need a security plugin?
It helps, especially with scanning and blocking attacks, but it is not magic. It works best together with updates, strong passwords, good hosting and backups.
How often should I back up?
It depends on how often your site changes. A site that changes weekly needs at least weekly backups, and a shop with daily orders needs daily ones, or even more often.
Should I pay for a premium theme or plugin?
If a paid product is the best tool for the job, buy it from the real author or a reputable marketplace. It is much safer than a free pirated copy, and you receive updates and support.
Can I fix a hacked site myself?
You can try the steps above, but cleaning malware is hard to do thoroughly. If the site matters to your business, ask a professional or your hosting company for help.
Want Your WordPress Site Checked?
If you want to know how safe your website is, or you need help protecting or cleaning it, I can help. I design and develop websites for businesses, and I can review your site, close the common doors and set up proper backups. Send me a short message with your website address.
