The 20 Best WordPress Security Tips on the Web

Elizabeth R. Cournoyer June 8, 2025

147 8 minutes read

Summary show

Attempting to improve WordPress protection?

You are up-to-date and updated to be. An investigation revealed about 70% of WordPress blogs are up-to-date hacker attacks. I’ve rounded up a number of the up-to-date WordPress security weblog posts for you. These posts contain a vast number of tips, insights, and analyses. Let’s get started. Audit your wordpress protection

1. Audit Your security

Web synthesis begins where you up-to-date begin—a protection audit. Any security holes outside of WordPress, in software programs and hardware you operate with, can affect the CMS itself. That is a fantastic tip. Your WordPress website will only be as secure as the weakest hyperlink.

2. Use nicely-recognized up-to-date

The subject matter Foundry gives this notable advice: In case you had been trying upupdated keep away from getting mugged, would you explore darkish alleys late at night, or could you stroll down the busy fundamental street in broad daytime? Do not forget this recommendation while deciding on a WordPress plugin or subject matter. Get your topics or plugins from legitimate assets so they’re much more likely updated and up-to-date for protection issues. Be sure to update it when the plugin or subject is updated and closing up to date. Whatever months can be abandoned via the developer(s) – placing your WordPress blog at the chance.

3. Generate up-to-date mystery Keys

In Vivek Kumar Poddar’s 10 essential WP tips, he reminds us of the date to create your very own mystery keys: wp-config. Personal home page records are up-to-date with all the secrets of your WordPress setup. It is up to date with your MySQL database username, database password, and the name of the game key. Usually, it’s the most critical report, up-to-date entire website’s folder shape, and its additionally important up-to-date trade, with all its default values updated and generated ones. You can generate the up-to-date updated mystery key from this reputable API page. When you visit the web page, press f5 up-to-date, refresh the web page and seize the newly generated and precise secret key. Update wordpress for better protection

4. Update the whole thing

WooThemes reminds us that date replaces everything – not simply WordPress itself. Subject matters and plugins are merely as vital up-to-date protection as the WordPress middle. Many hackers will deliberately target older variations of WordPress with acknowledged protection troubles, so maintain an eye on your Dashboard notification region and don’t ignore the’ Please update now’ messages.

Don’t forget about this!

The same applies to up-to-date subjects and plugins. Ensure you update the present-day variations as they are launched. If you preserve everything, your website is much less likely to get hacked.

[ois skin=” WordPress Optimization”]

WordPress

Read More Articles :

5. Protect up-to-date Malicious URLs

I discovered this nugget over at A place up-to-date accumulate WordPress code snippets:

global $user_ID; if($user_ID) {
if(!current_user_can(‘administraupdatedr‘)) {
if (strlen($_SERVER[‘REQUEST_URI’]) > 255 ||

stripos($_SERVER[‘REQUEST_URI’], “eval(“) ||

stripos($_SERVER[‘REQUEST_URI’], “CONCAT”) ||

stripes($_SERVER[‘REQUEST_URI’], “UNION+choose”) ||

stripos($_SERVER[‘REQUEST_URI’], “base64”)) {
@header(“HTTP/1.1 414 Request-URI Too lengthy”);

@header(“fame: 414 Request-URI Too lengthy”);

@header(“Connection: close”);

@go out;

This code snippet is supposed uto be up to date ato assist save your URL injection assaults.

Forestall personal home page code execution in wordpress

6. Up-to-date PHP Execution in WP-content

The map-to-date soup has a fantastic roundup of updated, relaxed pages via htaccess modifications. The up-to-date tip here is the updated location, an htaccess inner of your wp-content material up to date with: order denies, allow deny from all Allow from all this may block personal home page fil1es from executing interior of this up-to-date. We regularly see this used up-to-date upload personal home page backdoors.

7. Eliminate Unused Plugins & issues

This is an excellent tip from Copyblogger. Suppose you have vintage issues and plugins that you’re not using anymore. In that case, specifically, if they haven’t been upupdated, you may essentially just go beforehand and begin the countdown up-to-date next safety breach. A messy website also makes it much harder for protection experts to function up to date if your site is compromised.

We simply treated a case like this. The up-to-date had tried unsuccessfully to clean up their WordPress blogs most effectively up to date be attacked once more. The problem? They did not clean out a vintage subject matter with a Hypertext Preprocessor shell backdoor. As quickly as the code injections have been removed, the attackers simply used the backdoor to date and put them lower back again. So continually delete — now, not just disable — what you are not using. Use strong passwords for better wordpress protection

8. Use strong Passwords

WordPress.com – the industrial side of WP has a fantastic article on selecting robust passwords. They remind us that modern-day structures effortlessly crack random passwords, so you up-to-date use higher techniques like a password manager.

9. Delete extra money owed

Zoe Rooney gives this recommendation: Once you’ve got a superb, relaxed new admin consumer for yourself, take up-to-date updates of another consumer’s bills beneath up to datemersupdated > All cusupupdated. Delete any previous (or convert them to updated subscriber popularity). I can’t stress this enough. Also, look at any consumer debts created via your developers—people frequently use terrible passwords at some point in development; if these aren’t changed, they can be an easy backdoor in updating your WP setup.

10. Test record Permissions

Why do so many people forget about the Codex? I will update by no means now. There’s an exceptional little WordPress safety tip in up-to-date 9.2. While you tell WordPress to carry out an automatic replacement, all record operations are finished as the person who owns the files, not as the web server’s person. All documents are updated to 0644, and all direcupdatedries are updated to 0755, and writable with the aid of the handiest user and readable via each person else, including the updated internet server. I’m not sure how sturdy WordPress’s record permission checking is. A problem here is that an automated update may also fail if a record isn’t writable through WordPress. If this isn’t trapped as a blunder, you can assume you’re going for walks with a completely updated patched version while you are not.

Security PHP

11. Exchange personal home page safety Settings

while I don’t recognize all of those paintings up to date on your updated weblog, wpsecure.net gives this listing of php adjustments:

display_errors = Off //secure up-to-date disable on live website

register_globals = Off //off through default; however, a terrific reminder up-to-date check updated

expose_php = Off //secure up to date disable

allow_url_fopen = Off //might destroy something

allow_url_include = Off //may break something

log_errors = On //logging mistakes is constantly a terrific idea if you take a look at them

error_log = /var/log/phperror

enable_dl = Off //would possibly spoil something

disable_functions=” open, exec, device,pass-thru,proc_open,shell_exec,show_source, Hypertext Preprocessor

file_uploads = Off //will maximum in all likelihood smash something
In addition, they have updated different guidelines for hardening WordPress by getting below the hood. If you try any WordPress security recommendations, make a certain updated backup and test them first. Since you are editing code, the up-to-date update spoils your site.

12. Get a better hosting

Even as not pretty WordPress particular, ElegantThemes reminds us of up-to-date RAID. If you reflect on it, the server’s disks are the most precious part of the server to date. They have got your information. The shield is in opposition to updated downtime and information loss caused by using redundant disks. If you use shared hosting or a WP website hosting service, ask them what kind of disk gadget they use. Look for a new host if they no longer use a redundant RAID or SAN. Use https for higher wordpress protection

13. Pressure SSL utilization

any other simple but upupdated tip comes from Smashing mag: Once you’ve checked that your net server can deal with SSL, definitely open your wp-config php report (placed at the foundation of your WordPress setup), and paste the subsequent outline(‘FORCE_SSL_ADMIN’, real); while you operate HTTP, your password is sent as simple textual content across the internet. By using HTTPS, you may, at a minimum, upload a layer of safety.

14. Block Brute pressure assaults

As encouraged using WP amateur, you up to date updated restriction WP login attempts. Why? Restricting the failed login tries will lock a person out if they enter the incorrect password at an extra time than the specified time. They may be locked out for a certain time. You may manage the settings from your admin panel. This will help add up-to-date updates to see how many people are trying upupdated to hack your website online. If you see the same IP up-to-date updated on your website, then you may BAN that IP copes with. If you have a limited range of up-to-date datemersupdated, I choose to log down to wp-login with HTTP Auth. However, if you have a lot of up-to-date, this could be difficult. In this case, I updated to advise the restriction Login attempts plugin.

15. Configure automated core Updates

As WPTavern up-to-date out:

Its protection and minor releases are the up-to-date essential differences right here. These commonly do not destroy everybody’s website, plugin, or subject matter. If you’re using a plugin that receives a broken-up date or updated safety launch, that increases a red flag and causes questions about how that plugin interacts with the WordPress middle.
So depart those up-to-date updates on.

16. Discover Hacked WordPress files

Sarah Gooding has an up-to-date roundup on up-to-date dateolsupdated. You can use updated find hacked WordPress documents. She opinions:

Take advantage of Scanner
Sucuri
Wordfence
WordPress document moniupupdated Plus
if you think you’ve been hacked, try out those gear.

17. Exchange Database Prefix

Tutsplus reminds us to update and alternate the default prefix up to date. The fact updated: Many of the simple setup stuff for WordPress is identical throughout many websites… especially if you use a one-step install wizard through your WebHost. This is fantastic and handy; however, plenty of unusual setup values like your database prefix(es) are recognized by updated hackers as an end result. If you don’t exchange the database prefix, the desk names of your website’s database are easily identified and updated by the person trying upupdated hack your web page. This can not deter an experienced hacker; however, it can assist with bot attacks.

18. Rethink Security Plugins

Joyce Grace at ManageWP brings up a great, up-to-date, approximately safe plugin: One fact updated to date is that once you use protection plugins with WordPress, you need an up-to-date understanding of what you’re doing. The use of a protection plugin, although reputedly clean, can also motivate troubles; up-to-date updates provide solutions for the ‘average’ WordPress person. Look athe entire to submit for a terrific dialogue on this WordPress safety update.

19. Backup Your WordPress web page

You can still get hacked even by imposing these types of WordPress safety guidelines. Freddy at WPExplorer reminds us of the up-to-date backup of our website. And recommends three plugins:

Backup WordPress

WP DB Backup

VaultPress light