BlogHosting & domains
Securing a WordPress site
By Micah Ondiwa, Senior Software Engineer 1 min read
Updates, strong admin accounts, fewer plugins, backups and a web application firewall protect the most targeted CMS.
WordPress powers many sites, which makes it a common target.
Keep everything updated
Core, themes and plugins.
Use fewer plugins
Every plugin adds risk. Remove what you do not use and choose well-maintained ones.
Protect admin accounts
Strong passwords, multi-factor authentication and no shared admin logins.
Limit login attempts
Block repeated failed logins.
Back up
Automated, off-server backups.
Consider a firewall
A web application firewall blocks common attacks.
Use separate accounts
Give each editor their own account with the lowest role they need — editors do not need administrator rights.
Keep the hosting secure too
Use secure file transfer, strong hosting control panel passwords and the latest supported PHP version. A secure WordPress installation on an insecure hosting account is still at risk.
Monitor
Uptime monitoring and file change alerts help you notice problems quickly.
About the author
Micah Ondiwa
Senior Software Engineer
Micah Ondiwa writes about software engineering — application architecture, APIs and integration, data and AI-assisted development, and reliable delivery.