7 WordPress Security Tricks to Keep Your Website Protected
On this page
Want this handled for you?
Get startedHow do you keep a WordPress site secure?
WordPress is popular, so hackers target it. Most threats can be stopped with seven simple habits: SSL, login limits, strong passwords, updates, backups, a firewall and a custom login URL.
These seven WordPress security tricks stop most of the attacks a typical site will ever see. WordPress is a trusted, reliable way to run a website, but because it’s so popular, hackers target it, and every site is vulnerable to some degree. The good news: you don’t need to be a developer to close the most common gaps. A little time spent on the habits below goes a long way.
Why simple WordPress security tricks work
Most attacks on WordPress sites aren’t personal. They’re automated: bots scan thousands of sites a day, looking for the easy ones. They try common passwords on the default login page, look for plugins with known holes that were never updated, and probe sites that send data without encryption. If your site isn’t an easy target, most of these bots simply move on.
That’s why basic WordPress security tricks matter so much. None of them is clever on its own, but together they remove the weak spots automated attacks rely on. Each one takes minutes to set up, and most of them then run in the background.
WordPress.org’s own guide to hardening WordPress covers the same ground in more technical depth. If you like to know the “why” behind each step, it’s a good read once you’ve worked through the list below.
Start with an SSL certificate
An SSL certificate encrypts everything that travels between your visitors and your site, such as logins, form entries and customer details. Only the intended recipient can read it, so the data can’t be picked off along the way. It’s also what puts the padlock and https:// in front of your address, and browsers warn visitors about pages that send form data without it.
Many hosts include a free certificate (often from Let’s Encrypt) that you can switch on from the hosting control panel. Once it’s active, make sure your WordPress address and site address under Settings → General both start with https://, so every page loads securely.
Running a business with several subdomains, like a blog, a shop and a payments page? A wildcard SSL certificate covers your main domain and all of its first-level subdomains, so you don’t have to buy a separate certificate each time you add one. Brands such as RapidSSL, Sectigo (formerly Comodo) and Thawte offer wildcard certificates, and Let’s Encrypt issues them free if your host supports it.
Limit login attempts
By default, WordPress lets anyone try to log in as many times as they like. That’s handy when you mistype a password, but it also leaves the door open to brute-force attacks, where a bot tries thousands of passwords in a row.
Limit the number of attempts and attackers get locked out before they can guess their way in. A login-limiting or security plugin adds this setting in a few clicks. A sensible starting point is a handful of failed attempts before a short lock-out, which is longer for repeat offenders. Real users rarely notice; bots hit the wall almost at once.
For admin accounts, add two-factor authentication (2FA) on top. Even if a password leaks, nobody gets in without the second code from your phone.
Use strong passwords
Every site’s security starts with its passwords. A strong one is:
- Long, with a mix of letters, numbers and symbols
- Unique: not a common word and not used on any other site
- Changed straight away if you think it may have leaked
A password manager makes this easy: it creates and remembers long passwords for you. WordPress itself suggests a strong password whenever you create a user or reset one, so accept it rather than typing your own.
Passwords aren’t only for WordPress users. Your hosting account, your database and any FTP or SFTP accounts deserve the same care, because each one is a way into your site. And give every person their own account with the lowest role they need: an author doesn’t need administrator rights.
Keep WordPress, plugins and themes updated
Updating WordPress to the latest version is one of the best ways to keep your site safe. New releases ship with security fixes, so staying current protects you from attackers looking for known holes in older code. The same goes for your plugins and themes: update them for exactly the same reason. Outdated plugins are one of the most common ways into a WordPress site.
Two more habits help here. Delete plugins and themes you no longer use, because a deactivated plugin can still contain vulnerable code. And only install plugins from sources you trust, such as the WordPress.org directory or the developer’s own site. The official Updating WordPress guide explains how core updates work, including automatic background updates.
Back up often
A backup is a copy of all your site’s files and data, stored somewhere else. Of all the WordPress security tricks, this is the one that saves you when everything else fails: if you ever lose everything, you still have a way back.
A complete backup has two parts: the files (WordPress itself, your themes, plugins and uploaded media) and the database (your posts, pages, settings and, on a shop, your orders). Make sure your backup tool saves both. Keep backups offline or in the cloud, away from your web server, and you can recover quickly even after a disaster. A backup that only lives on the same server can disappear with it.
Finally, test a restore now and then. A backup you have never restored is a hope, not a plan.
Add a firewall to your site
You probably have a firewall on your computer. Your WordPress site deserves one too. A website firewall adds an extra layer of protection that filters out malware attacks, malicious bots and other bad traffic before it reaches your site.
There are two common kinds. A plugin firewall runs inside WordPress and inspects requests as they arrive. A cloud or DNS-level firewall sits in front of your server, so bad traffic is filtered before it even reaches your host, which also takes load off the server. Either is far better than none. Pair the firewall with regular malware scans, so anything that slips through is found early.
Rename your login URL
By default, everyone logs in at /wp-admin or /wp-login.php after your domain. Attackers know this too, which makes your login page easy to find. Change it to a custom address and automated attacks have a much harder time guessing where to knock.
Most security plugins include this option. Write the new address down (or bookmark it) before you save, and tell everyone who logs in, so nobody gets locked out.
What each of the WordPress security tricks stops
Each habit covers a different weak spot, which is why they work best together.
| Trick | What it protects against | Effort |
|---|---|---|
| SSL certificate | Data being read on its way between visitor and site | Low |
| Login limits | Brute-force password guessing | Low |
| Strong passwords | Guessed or reused passwords | Low |
| Updates | Known security holes in old code | Ongoing |
| Backups | Losing your site after a hack or crash | Ongoing |
| Firewall | Malware attacks and malicious bots | Low |
| Custom login URL | Automated bots hitting the default login page | Low |
In what order should you do them?
If you’re starting from scratch, this order gets the biggest wins first:
- Back up the whole site, so nothing you change can cost you data.
- Update WordPress, plugins and themes, and delete what you don’t use.
- Change weak passwords and remove old user accounts.
- Switch on SSL if your site doesn’t load over
https://yet. - Install a security plugin for login limits, a firewall, malware scans and a custom login URL.
After that, the WordPress security tricks become routine: updates and backups on a schedule, and a quick look at your security plugin’s reports now and then.
The bottom line
If you take a back seat on security, attackers can get into your site and damage it inside and out. That’s a scary thought, but it doesn’t have to happen. Put these seven WordPress security tricks in place today: the security you give yourself and your visitors is in your hands. And if you’d rather hand the routine work to someone else, our WordPress website security service takes care of it.
Frequently asked questions
There is no single fix: the seven WordPress security tricks work together. If you only do one thing today, update WordPress core, plugins and themes, because updates patch known security holes.
They stop most automated attacks, which is what the average site faces. Sites that handle payments or a lot of personal data need more, such as regular malware scans, activity logs and a tested recovery plan.
Not on its own. It cuts down automated login attempts, but it hides the door rather than locking it. Use it together with login limits and strong passwords.
As often as your site changes. A shop that takes orders every day needs daily backups; a site that rarely changes can be backed up less often. Always keep a copy away from your web server.
Yes. Every Jompom plan includes WordPress core, plugin and theme updates, cloud backups, uptime monitoring and a security scan, with a report for every task. See the plans.