How to secure a WordPress site

Because it is so popular, WordPress is attackers' favorite target. The good news: a few simple measures make it much safer.

1. Update everything

Most hacked sites run old versions. Keep WordPress, themes and plugins up to date, ideally with automatic updates.

2. Strong passwords and two-factor authentication

The admin account must have a long password and, ideally, two-factor authentication through a security plugin.

3. Protect the login page

Limit login attempts and protect the server with fail2ban. You can also move the login page to a less obvious address.

4. HTTPS is mandatory

Serve the whole site over HTTPS, see free SSL certificate and forcing HTTPS.

5. Correct permissions

WordPress files should be 644 and directories 755, see file permissions. Do not leave wp-config.php publicly accessible.

6. Security headers and a firewall

Add security headers and a firewall.

7. Regular backups

Even the safest site can go down. Back up to a Backup Box, see backing up WordPress, so you can recover quickly.