Secure a WordPress site

Almost every compromised WordPress site we see was running an outdated plugin, reusing a password, or both. The fixes are unglamorous and they work.

Keep everything current

Enable automatic updates for core and plugins. On WordPress Hosting plans this is on by default and a backup is taken before each update, so a bad release can be rolled back from cPanel. Remove plugins and themes you are not using — an inactive plugin is still code on disk, and it is still a target.

Protect the login

• Use a unique password for the WordPress admin account and store it in a password manager.
• Enable two-factor authentication for every administrator.
• Remove the default 'admin' username if one exists.
• Leave login rate limiting enabled — it is applied at the server on our platform.

Get file permissions right

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 600 wp-config.php

Directories at 755, files at 644, and wp-config.php locked down further. If a guide tells you to set anything to 777, close it and find a better guide.

If you think you have been compromised

Open a ticket. We can scan the account server-side and tell you which files were modified and when. Restore from a backup taken before the modification date, then update everything and rotate passwords before the site goes back online.