The vast majority of compromised WordPress sites are hacked due to a vulnerability already patched months ago, or due to a weak password. Securing a WordPress site therefore relies less on exotic configurations than on a few habits maintained over time.
The most effective measure, by far: keeping WordPress, plugins, and themes up to date. None of the other measures on this page compensate for a site left without updates.
The commands below are executed with WP-CLI, available on your hosting via SSH access (see the article dedicated to wp-cli). Everything described here can also be done from the WordPress dashboard.
In short: keep WordPress, plugins and themes up to date, lock down access (no admin account, unique passwords, two-factor authentication), delete what you do not use, force HTTPS and know how to restore a backup.
1. Update, systematically
wp core update
wp plugin update --all
wp theme update --all
To stop worrying about it, enable automatic updates:
wp plugin auto-updates enable --all
wp theme auto-updates enable --all
Also ensure you are using a supported PHP version: an end-of-life version no longer receives security patches. This choice is made in the Apanel console, Hosting management > Web technologies card > PHP configuration (see Change the PHP version and configuration of your website).
2. Lock down access
- No account named
admin. This is the first username tested by bots. Create an administrator account with a different name, then delete the old one while reassigning its content.
- A long and unique password per account, never reused elsewhere.
- Two-factor authentication on all administrator accounts.
- Login attempt limiting, to cut short brute-force attacks.
Review who holds administrative rights:
wp user list --role=administrator
After a provider leaves or in case of any doubt, reset passwords and invalidate all open sessions:
wp user reset-password <utilisateur>
wp config shuffle-salts
shuffle-salts regenerates the security keys: all users are logged out, including anyone who might have stolen a session.
3. Reduce the attack surface
Every plugin and every theme is additional executable code. An inactive theme remains present on the disk and may be vulnerable.
- Delete (and do not just deactivate) everything you do not use.
- Avoid plugins that are no longer maintained by their author.
- Install only from the official repository or the vendor, never from an archive found at random.
wp plugin delete <extension>
wp theme delete <theme>
How do I disable the file editor?
By default, an administrator account can modify theme and plugin code from the browser. This is exactly what an attacker needs after stealing a password.
wp config set DISALLOW_FILE_EDIT true --raw
4. How do I force HTTPS for administration?
A username transmitted in plain text can be intercepted. Enable a certificate (see Setting up an SSL certificate), then force administration over HTTPS:
wp config set FORCE_SSL_ADMIN true --raw
5. Back up, and know how to restore
A backup is only valuable if you know how to use it. Your hosting keeps restore points: see How to restore data. Test the procedure once, offline, rather than on the day of an incident.
To also keep your own copy, outside your hosting, create an archive of the files and the database before each major update: see Back up or export your site as a downloadable archive.
6. What should I check from time to time?
A few minutes per quarter are enough to detect an anomaly.
| Check |
Command |
| Modified core files |
wp core verify-checksums |
| Modified plugins |
wp plugin verify-checksums --all |
| Unknown administrators |
wp user list --role=administrator |
| Suspicious scheduled tasks |
wp cron event list |
wp plugin verify-checksums only covers plugins published on WordPress.org: premium or custom plugins must be checked differently.
Your site is already compromised?
Do not just apply the measures above: an update does not remove a backdoor. Follow the cleaning procedure described in Clean up a WordPress site after a hack.
Need help?
Open a request with our support, specifying the domain concerned and what you have already put in place.
Going further