{"id":17794,"date":"2011-03-10T23:08:09","date_gmt":"2011-03-10T17:38:09","guid":{"rendered":"https:\/\/www.quickonlinetips.com\/archives\/?p=17794"},"modified":"2026-10-12T09:28:52","modified_gmt":"2026-10-12T03:58:52","slug":"increase-wordpress-security","status":"publish","type":"post","link":"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/","title":{"rendered":"How to Increase WordPress Security: 12 Steps That Work (2026)"},"content":{"rendered":"<p>How can you increase WordPress security? WordPress runs a huge share of the web, so bots attack every WordPress site daily, mostly with automated scripts aimed at weak passwords and outdated plugins. The good news: a few easy steps stop almost all of them. Here is how to <strong>increase WordPress security<\/strong> in 2026, updated from Thomas Frank&#8217;s original guest guide.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-39067\" src=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/717372511_b80baaf678.jpg\" alt=\"Increase WordPress security\" width=\"500\" height=\"375\" srcset=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/717372511_b80baaf678.jpg 500w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/717372511_b80baaf678-150x112.jpg 150w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/717372511_b80baaf678-300x225.jpg 300w\" sizes=\"(max-width: 500px) 100vw, 500px\" \/><\/p>\n<p><strong>Quick answer:<\/strong> Keep WordPress core, themes and plugins updated (turn on auto-updates), delete what you don&#8217;t use, use strong unique passwords with two-factor authentication, limit login attempts, add a firewall such as Wordfence or Cloudflare, run HTTPS, take automatic off-site backups, and never use the username &#8220;admin&#8221;.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6ad5804e308fc\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"ez-toc-cssicon\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #1a202c;color:#1a202c\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #1a202c;color:#1a202c\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ad5804e308fc\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#Common_WordPress_attacks\" >Common WordPress attacks<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#12_steps_to_increase_WordPress_security\" >12 steps to increase WordPress security<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#1_Keep_everything_updated\" >1. Keep everything updated<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#2_Delete_unused_plugins_and_themes\" >2. Delete unused plugins and themes<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#3_Never_use_%E2%80%9Cadmin%E2%80%9D_as_a_username\" >3. Never use &#8220;admin&#8221; as a username<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#4_Use_strong_passwords_and_two-factor_authentication\" >4. Use strong passwords and two-factor authentication<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#5_Limit_login_attempts\" >5. Limit login attempts<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#6_Add_a_firewall\" >6. Add a firewall<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#7_Use_HTTPS_everywhere\" >7. Use HTTPS everywhere<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#8_Hide_login_error_details\" >8. Hide login error details<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#9_Harden_wp-configphp\" >9. Harden wp-config.php<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#10_Turn_off_XML-RPC_if_you_dont_need_it\" >10. Turn off XML-RPC if you don&#8217;t need it<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#11_Take_automatic_off-site_backups\" >11. Take automatic off-site backups<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#12_Give_users_only_the_role_they_need\" >12. Give users only the role they need<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#What_about_changing_the_wp_table_prefix\" >What about changing the wp_ table prefix?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#FAQ\" >FAQ<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#Is_WordPress_secure\" >Is WordPress secure?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#Do_I_need_a_security_plugin\" >Do I need a security plugin?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/increase-wordpress-security\/#What_should_I_do_if_my_WordPress_site_is_hacked\" >What should I do if my WordPress site is hacked?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Common_WordPress_attacks\"><\/span>Common WordPress attacks<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>Brute-force logins:<\/strong> bots try thousands of username and password pairs on <code>wp-login.php<\/code> and <code>xmlrpc.php<\/code>.<\/li>\n<li><strong>Vulnerable plugins and themes:<\/strong> most hacked sites today are hacked through an outdated or abandoned plugin, not WordPress core.<\/li>\n<li><strong>SQL injection and XSS:<\/strong> malicious input sent through forms, search boxes or URLs.<\/li>\n<li><strong>Stolen credentials:<\/strong> passwords reused from other leaked sites, or phished admin logins.<\/li>\n<li><strong>Spam comments:<\/strong> link spam and malicious URLs posted by bots.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"12_steps_to_increase_WordPress_security\"><\/span>12 steps to increase WordPress security<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"1_Keep_everything_updated\"><\/span>1. Keep everything updated<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>WordPress installs minor security releases automatically. In <strong>Dashboard &gt; Updates<\/strong> and on the Plugins and Themes screens, turn on auto-updates for plugins and themes you trust. Also run a supported PHP version (8.2 or newer); your host&#8217;s control panel lets you switch.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"2_Delete_unused_plugins_and_themes\"><\/span>2. Delete unused plugins and themes<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>A deactivated plugin can still be exploited if its files are on the server. Delete anything you don&#8217;t use and keep one default theme as a fallback. Avoid plugins that haven&#8217;t been updated for a year or more.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"3_Never_use_%E2%80%9Cadmin%E2%80%9D_as_a_username\"><\/span>3. Never use &#8220;admin&#8221; as a username<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Brute-force bots try &#8220;admin&#8221; first. Create a new administrator with a different username, log in as that user, then delete the old &#8220;admin&#8221; account and assign its posts to the new user. No SQL is needed.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"4_Use_strong_passwords_and_two-factor_authentication\"><\/span>4. Use strong passwords and two-factor authentication<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Use a password manager to create long unique passwords, and add two-factor authentication (2FA) for every admin and editor. The free Two Factor plugin from WordPress contributors, Wordfence and Jetpack all offer authenticator-app codes.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"5_Limit_login_attempts\"><\/span>5. Limit login attempts<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Plugins such as Limit Login Attempts Reloaded block an IP after a few failed tries. Many hosts, including Hostinger, also rate-limit logins at server level.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"6_Add_a_firewall\"><\/span>6. Add a firewall<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li><strong><a href=\"https:\/\/www.wordfence.com\/\" target=\"_blank\" rel=\"noopener\">Wordfence<\/a><\/strong>: free plugin firewall and malware scanner.<\/li>\n<li><strong><a href=\"https:\/\/www.cloudflare.com\/\" target=\"_blank\" rel=\"noopener\">Cloudflare<\/a><\/strong>: free plan blocks many bad bots before they reach your server.<\/li>\n<li><strong><a href=\"https:\/\/sucuri.net\/\" target=\"_blank\" rel=\"noopener\">Sucuri<\/a><\/strong>: paid cloud firewall and malware clean-up.<\/li>\n<\/ul>\n<p>Compare more options in our list of the <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/wordpress-security-plugins\/\">best WordPress security plugins<\/a>.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"7_Use_HTTPS_everywhere\"><\/span>7. Use HTTPS everywhere<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Install a free Let&#8217;s Encrypt SSL certificate from your host and make sure every page loads over https, so logins and cookies are encrypted.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"8_Hide_login_error_details\"><\/span>8. Hide login error details<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>By default WordPress says whether the username or the password was wrong. The old <code>create_function()<\/code> snippet no longer works on PHP 8, so use this in a code snippets plugin or your child theme&#8217;s <code>functions.php<\/code>:<\/p>\n<pre><code>add_filter( 'login_errors', function () {\n    return 'Login failed. Please try again.';\n} );<\/code><\/pre>\n<h3><span class=\"ez-toc-section\" id=\"9_Harden_wp-configphp\"><\/span>9. Harden wp-config.php<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<ul>\n<li>Change your <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2011\/03\/wordpress-secret-keys-better-wordpress-security\/\">WordPress secret keys<\/a> after any incident.<\/li>\n<li>Add <code>define( 'DISALLOW_FILE_EDIT', true );<\/code> to switch off the built-in theme and plugin file editor.<\/li>\n<li>WordPress also looks for <code>wp-config.php<\/code> one folder above the site root, which keeps it out of the public folder on some hosts.<\/li>\n<li>Set file permissions to 644 for files and 600 or 640 for <code>wp-config.php<\/code>.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"10_Turn_off_XML-RPC_if_you_dont_need_it\"><\/span>10. Turn off XML-RPC if you don&#8217;t need it<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>XML-RPC is used by some apps and Jetpack, but bots abuse it for brute-force attacks. If you don&#8217;t use it, block it with your security plugin or Cloudflare.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"11_Take_automatic_off-site_backups\"><\/span>11. Take automatic off-site backups<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Backups are your safety net when everything else fails. Use <strong><a href=\"https:\/\/updraftplus.com\/\" target=\"_blank\" rel=\"noopener\">UpdraftPlus<\/a><\/strong>, <strong><a href=\"https:\/\/jetpack.com\/\" target=\"_blank\" rel=\"noopener\">Jetpack VaultPress Backup<\/a><\/strong> or your host&#8217;s daily backups, and keep a copy off the server. Here is how to <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2015\/02\/backup-websites-on-hosting-server\/\">back up websites on your hosting server<\/a>.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"12_Give_users_only_the_role_they_need\"><\/span>12. Give users only the role they need<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Writers should be Authors or Contributors, not Administrators. Remove accounts of people who no longer work on the site.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"What_about_changing_the_wp_table_prefix\"><\/span>What about changing the wp_ table prefix?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The original guide recommended renaming database tables. It adds little protection today and can break a site if done wrong. If you are installing fresh, pick a custom prefix during setup; on an existing site, focus on the steps above instead.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"FAQ\"><\/span>FAQ<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Is_WordPress_secure\"><\/span>Is WordPress secure?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes. WordPress core has a dedicated security team. Most hacks come from outdated plugins, weak passwords and poor hosting.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Do_I_need_a_security_plugin\"><\/span>Do I need a security plugin?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Not strictly, but a firewall and login protection make attacks much harder. Use one good suite rather than several overlapping plugins.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"What_should_I_do_if_my_WordPress_site_is_hacked\"><\/span>What should I do if my WordPress site is hacked?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Restore a clean backup, update everything, change all passwords and secret keys, and scan for malware. If unsure, use a professional clean-up service.<\/p>\n<p><em>Originally written by guest author Thomas Frank, founder of College Info Geek, a student success blog. Updated for 2026 by QuickOnlineTips. Image courtesy of Flickr user Max Klingensmith.<\/em><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How can you increase WordPress security? WordPress runs a huge share of the web, so bots attack every WordPress site&#8230;<\/p>\n","protected":false},"author":4,"featured_media":39067,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[6,7],"tags":[44,49,17],"class_list":["post-17794","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogging","category-security","tag-guest-posts","tag-tutorials","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/17794","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/comments?post=17794"}],"version-history":[{"count":1,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/17794\/revisions"}],"predecessor-version":[{"id":64123,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/17794\/revisions\/64123"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media\/39067"}],"wp:attachment":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media?parent=17794"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/categories?post=17794"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/tags?post=17794"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}