How to Keep Your WordPress Site Secure

WordPress's popularity is exactly why it's such a common attack target — but a handful of habits close most of the gaps attackers look for.

Keep Everything Updated

WordPress core, themes, and every plugin should be updated promptly. Outdated plugins with known vulnerabilities are the single most common way WordPress sites get compromised.

Remove What You Don't Use

Deactivated plugins and themes can still be exploited if left installed. Delete anything you're not actively using.

Use Strong Admin Credentials

Never use "admin" as your username, use a long unique password, and enable two-factor authentication for every admin account.

Limit Login Attempts

Install a plugin or use server-level protection to lock out IPs after repeated failed login attempts.

Choose Plugins Carefully

Stick to well-reviewed, actively maintained plugins from reputable developers. An abandoned plugin with no recent updates is a liability, even if it currently works fine.

Back Up Before Every Update

A quick backup before updating core, themes, or plugins means a bad update is a five-minute rollback instead of an emergency.

Further Reading

• SSL Certificates
• Talk to Our Security Team
• Get Cyber Safe – Government of Canada