WordPress Security Tips: How to Protect Your Website from Hacking

WordPress powers a huge share of the world's websites, and that makes it a favourite target for hackers. Most attacks are not personal. Automated bots scan thousands of sites every day, looking for an old plugin, a weak password or a forgotten admin account. When they find one, the site is used to send spam, redirect visitors to scam pages or host malware. Google may then show a "This site may be hacked" warning, and your customers stop trusting you. These WordPress security tips will protect your website from most of these attacks. You do not need to be a programmer to follow them.

Why small business websites get hacked

Many business owners in Noakhali and across Bangladesh think, "My website is small, nobody will attack it." But bots do not care how big you are. They attack anything they can break. The most common reasons a WordPress site gets hacked are:

• Outdated plugins, themes or WordPress core with known security holes;
• Weak or reused passwords, especially for the admin account;
• "Nulled" (pirated) premium themes and plugins with hidden malicious code;
• Old staff or developer accounts that were never removed;
• Cheap hosting where one infected website can affect others on the same account;
• No backups, so a small infection becomes a disaster.

1. Keep everything updated

This is the most important of all WordPress security tips. When a security hole is found in a plugin, the developer releases an update, and the details become public. Bots start scanning for unpatched sites within days.

• Update WordPress core, themes and plugins regularly — at least once a week for busy sites.
• Turn on automatic updates for minor WordPress releases and for trusted plugins.
• Take a backup before big updates, and check the site afterwards.
• Delete plugins and themes you do not use. Deactivated plugins can still be attacked. Keep only one default theme as a fallback.
• Replace plugins that have not been updated by their developer for a long time.

2. Never use nulled themes or plugins

"Free" copies of premium themes downloaded from unofficial sites are one of the most common causes of hacked websites we see. They often contain hidden backdoors that let the attacker back in even after you clean the site. They also never receive security updates. Buy premium themes and plugins from the original developer, or use well-maintained free ones from WordPress.org.

3. Use strong passwords and unique usernames

• Do not use "admin" as the username. If your site already has an "admin" user, create a new administrator with a different name, log in with it, and delete the old one (assign its posts to the new user).
• Use long, random passwords — at least 14 characters — and a password manager to remember them.
• Never reuse your email or Facebook password for WordPress.
• Change passwords when a staff member or freelancer leaves.
• Remember that your hosting cPanel, FTP and database passwords matter too. A strong WordPress password does not help if cPanel uses "123456".

4. Turn on two-factor authentication

Two-factor authentication (2FA) asks for a six-digit code from an app such as Google Authenticator after the password. Even if someone steals your password, they cannot log in without your phone. Plugins such as Wordfence, WP 2FA or Two Factor add this to WordPress in a few minutes. Enable it at least for every administrator and editor.

5. Limit login attempts and protect wp-admin

Bots try thousands of password combinations on wp-login.php. Stop them:

• Use a security plugin that limits login attempts and blocks repeat offenders.
• Add a CAPTCHA (for example Cloudflare Turnstile or Google reCAPTCHA) to the login form.
• Optionally change the login URL, which reduces bot noise (though it is not real security on its own).
• If only your office uses the admin area, ask your host whether wp-admin can be restricted further.

6. Give each person only the access they need

WordPress has user roles for a reason. A person who only writes news or blog posts should be an Author or Editor, not an Administrator. For news portals with many reporters this matters a lot: if one reporter's password is stolen, the damage stays limited. Review Users regularly and delete accounts that are no longer needed.

7. Install SSL and force HTTPS

SSL encrypts data between your visitors and your website, including passwords and form submissions. Browsers mark sites without HTTPS as "Not secure". Free SSL certificates are included with good hosting — all our hosting plans include free SSL. After installing it, make sure every page redirects from http:// to https://.

8. Choose secure hosting

Your host is your first line of defence. Look for:

• Account isolation, so one hacked site cannot infect others;
• Server-level firewall and malware scanning;
• Regular automatic backups that you can restore yourself;
• Recent PHP versions;
• Support that answers quickly when something goes wrong.

Our WordPress hosting includes free SSL, daily backups and local support in Bangla.

9. Back up — and test your backups

A backup is your insurance. If the worst happens, you can restore a clean copy instead of starting from zero.

• Keep daily backups for busy sites and at least weekly backups for small ones.
• Store at least one copy away from the server — for example Google Drive.
• Keep several older copies, because an infection may go unnoticed for a while.
• Once every few months, test a restore so you know it actually works.

10. Harden WordPress settings

• Disable file editing in the dashboard by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php. If an attacker gets in, they cannot edit theme files from the admin panel.
• Make sure directory listing is disabled.
• Keep correct file permissions (usually 644 for files and 755 for folders).
• Disable XML-RPC if you do not use the mobile app or Jetpack.
• Do not leave old copies such as backup.zip or old-site folders in public_html.

11. Use a security plugin and monitor

A good security plugin, such as Wordfence or Solid Security, adds a firewall, malware scanning and alerts. Configure email alerts so you know when an administrator logs in or files change. Also add your site to Google Search Console — Google will email you if it detects malware or spam on your pages.

What to do if your WordPress site is already hacked

1. Do not panic and do not delete everything. You may need the files to find how the attacker got in.
2. Change all passwords: WordPress, cPanel, FTP, database and email.
3. Contact your hosting provider; they may see the infected files in server logs.
4. Restore a clean backup from before the infection, then update everything immediately.
5. If there is no clean backup, scan and clean the files, remove unknown admin users and reinstall WordPress core files.
6. Find and close the hole — usually an outdated plugin — or the site will be hacked again.
7. If Google shows a warning, request a review in Search Console after cleaning.

WordPress security checklist

• WordPress, theme and plugins up to date
• No nulled themes or plugins; unused ones deleted
• No "admin" username; strong, unique passwords
• Two-factor authentication for all admins
• Login attempts limited, CAPTCHA on login
• Correct user roles; old accounts removed
• SSL installed and HTTPS forced
• Daily backups stored off-site and tested
• File editing disabled in wp-config.php
• Security plugin and Search Console alerts on

Frequently asked questions

Worried about your website's security? Contact us for a free security check.