Many websites use a content management system (CMS) to create and manage content. WordPress is probably one of the best-known CMS platforms, powering about 41% of all websites globally.
WordPress is widely used because it supports websites of different sizes and offers many customization options. Its widespread use also makes WordPress sites a common target for hackers.
This article explains how to secure a WordPress site using 11 main measures. Practices such as secure hosting, regular updates, unique passwords, and multi-factor authentication can reduce common security risks.
WordPress is secure at its core, but vulnerabilities can still appear in WordPress itself, plugins, themes, and other third-party components. WordPress core security and the security of third-party plugins and extensions should be assessed separately. Some plugins may contain vulnerabilities, including those from established developers.
WordPress is open source, and its developers regularly release fixes for reported security vulnerabilities. Even so, WordPress sites can still be affected by vulnerabilities such as cross-site scripting (XSS) and SQL injection.
Exploited vulnerabilities can lead to data breaches, service disruption, or unauthorized access. A study conducted in 2022 by Wordfence shows that XSS and CSRF vulnerabilities grew sharply in volume. These findings show why administrators should address known WordPress vulnerabilities.
Understanding common vulnerabilities can help administrators choose appropriate security measures.
Cross-site scripting, or XSS, accounted for nearly half of all vulnerabilities disclosed in 2022, with 1,109 submissions These types of vulnerabilities let attackers inject malicious scripts into web pages viewed by users. Of these vulnerabilities, 408 required administrative permissions to exploit, which limited their impact compared with XSS vulnerabilities that require fewer privileges.
The second most common vulnerability was cross-site request forgery (CSRF), with 377 disclosed cases. In a CSRF attack, an end user is tricked by an attacker into submitting a malicious request that inherits the victim’s identity and privileges to perform an undesired function on their behalf.
Authorization bypass vulnerabilities ranked third in the list of common vulnerabilities in2022. This category includes vulnerabilities primarily caused by incorrect or insufficient access control or authorization. These issues can let unauthorized users access protected resources or perform actions without the required permissions.
SQL Injection vulnerabilities were the fourth most common, with 200 cases disclosed. In these types of attacks, an attacker exploits a vulnerability in a web application’s database query construction, leading to unauthorized database access or content manipulation.
Information disclosure ranked fifth, with 73 disclosed vulnerabilities. This happens when a website unintentionally reveals sensitive information to its users. The exposed data can range from technical details of the web application to users' personal information.
A brute-force attack is an automated, trial-and-error method where an attacker cycles through large numbers of username and password combinations until a valid set of credentials is found. WordPress login pages are a common target because, by default, there is no limit on the number of login attempts.
Attackers typically use specialized software or botnets to send thousands of login requests per minute. Sites with weak or commonly used passwords are especially at risk. Brute-force attacks can also consume significant server resources, potentially slowing down or crashing a website even if the attacker never gains access. Defenses such as login attempt limits, CAPTCHA challenges, strong passwords, and multi-factor authentication (MFA) are effective against this type of attack.
A compromised WordPress site can affect both individual site owners and businesses. For businesses, it can lead to financial losses, loss of customer trust, or compliance penalties. A compromised site can also expose users' personal information.
WordPress site owners need security controls that reduce the risk of unauthorized access and data exposure. Site owners should apply preventive security measures before an incident occurs—doing so can reduce the risk of a successful cyberattack.
WordPress security involves several settings, tools, and maintenance tasks. WordPress security measures can use plugins or be configured without them. Security plugins can add controls such as login protection, malware scanning, or traffic filtering. That said, like any software, security plugins themselves can contain vulnerabilities or backdoors that hackers could exploit.
Some security defenses can also be configured directly in WordPress or on the server without a plugin. The appropriate approach depends on the security control and how the WordPress site is managed. Site owners can use plugins alongside WordPress, hosting, and server security settings where appropriate.
A secure WordPress site starts with appropriate server configuration, backups, and access controls, many of which are managed by the hosting provider. When comparing hosting providers, check what backups, encryption, access controls, and security updates they provide. The hosting provider should maintain the server and provide appropriate server-side security controls.
An SSL (Secure Sockets Layer) certificate encrypts the data exchanged between a visitor's browser and your WordPress server, preventing attackers from intercepting sensitive information such as login credentials, payment details, and personal data. When SSL is active, your site loads over HTTPS rather than HTTP, and browsers show a security indicator for HTTPS. (HTTPS protects the connection but does not prove that the website itself is trustworthy.)
Most reputable hosting providers now offer free SSL certificates through services like Let's Encrypt, and many include one-click installation. After you get a certificate, update your WordPress site URL in Settings > General to use https:// and redirect all HTTP traffic to HTTPS. Plugins such as Really Simple SSL can automate that redirect for you.
On WordPress sites running on Apache, the .htaccess file can also control redirects and access rules. For example, administrators can use it to redirect HTTP requests to HTTPS or block direct web access to sensitive files. Changes to “.htaccess” should be made carefully because incorrect rules can make parts of the site inaccessible.
Beyond protecting user data, HTTPS also benefits your search engine rankings. Google has used HTTPS as a ranking signal since 2014, so a properly configured SSL certificate can give your site a small but meaningful boost in search results. Renew your certificate before it expires, and check regularly that all pages, images, and scripts load over HTTPS to avoid mixed-content warnings.
Software, including WordPress themes, plugins, and the core itself, can contain vulnerabilities. Updates often include patches for known security vulnerabilities, so updating all the mentioned components is crucial. Installing current versions gives you the security fixes included in those releases.
Administrators should also protect the wp-config.php file, which contains important WordPress configuration settings. WordPress recommends restricting file permissions so that only the required user and web server processes can read it. On servers that support .htaccess, administrators can also use access rules to block direct web requests for wp-config.php.
Weak or reused login credentials make account compromise easier. Avoid using "admin" as your username, and ensure your passwords are complex and unique. Use a long, unique password or passphrase for every account. A business password manager like NordPass can help you create strong passwords and store them safely.
Limiting the number of failed login attempts can prevent brute-force attacks. WordPress offers various plugins that can lock out a user’s IP address after a certain number of failed login attempts is reached. This makes it more difficult for hackers to try username/password combinations to log in.
Adding CAPTCHA (Completely Automated Public Turing test to tell Computers and Humans Apart) to WordPress can help prevent spam and bot submissions on your forms. Bots are often used to launch various types of attacks, such as submitting spam comments, brute-forcing the WordPress login page, or submitting malicious code. CAPTCHA makes it harder for automated systems to interact with your site and potentially cause harm.
WordPress themes vary in code quality, maintenance, and update frequency. Choose themes from reputable sources that prioritize security and follow WordPress coding and security practices and receive regular updates. This reduces the likelihood of security vulnerabilities. Always check ratings, reviews, and update frequency before deciding on a theme.
Regular backups let you restore a WordPress site after data loss, corruption, or a security incident. If a usable backup is available, you can restore the site to an earlier state. Regular backups ensure that your website's content, including posts, pages, images, and databases, is securely stored and can be recovered. Store backups separately from the live website, restrict access to them, and run regular disaster recovery simulations.
Regular security scans can detect known vulnerabilities and malware. Use scan results to identify weaknesses that require action, then apply the appropriate fixes.
A web application firewall or WAF, monitors and filters HTTP traffic between the internet and your WordPress site, blocking malicious requests before they reach your server. A WAF works by comparing incoming traffic against a set of predefined rules designed to identify common attack patterns such as SQL injection, cross-site scripting (XSS), and file inclusion exploits.
WAFs are available in 2 main forms. A cloud-based WAF, offered by providers like Cloudflare or Sucuri, routes your site's traffic through external servers that inspect and filter requests before forwarding legitimate ones to your host. A plugin-based WAF, such as Wordfence, runs directly on your WordPress server and analyzes traffic at the application level.
Cloud-based WAFs can also absorb distributed denial-of-service (DDoS) attacks by distributing traffic across a global network, while plugin-based options provide more granular control over rules specific to your WordPress installation. Some site owners use both cloud-based and plugin-based WAFs. After installation, review your WAF's activity logs regularly to identify blocked threats and fine-tune rules to reduce false positives that could block legitimate visitors.
WordPress sites can accumulate plugins that are no longer used. Yet, outdated or unused plugins can pose a security risk to your website. If a plugin is not regularly updated by the developer, it may contain vulnerabilities that can be exploited by hackers. Remove plugins you no longer use so they cannot introduce additional vulnerabilities.
The WordPress measures above address security within the site and its hosting environment. Organizations can also control how administrators and other users connect to WordPress. Some organizations may also need network and identity controls outside WordPress. The following controls can restrict access to WordPress administration and related infrastructure.
A business VPN can restrict access to a private WordPress administration interface or hosting environment when access is limited to an authenticated gateway or approved IP address. Use HTTPS to encrypt browser-to-WordPress traffic, and on top of that, a business VPN can add protection when the WordPress administration interface or hosting environment is private and accessible only through an authenticated gateway or approved IP address.
MFA and SSO can reduce account-access risks for WordPress users and administrators. SSO allows users to authenticate once and gain access to multiple systems or applications without needing to log in separately. MFA requires another verification factor in addition to a password. Together, they make it much more difficult for unauthorized users to gain entry into your WordPress resources.
Restricting administrative access to approved connections can reduce unauthorized login attempts. By limiting connections only to trusted IP addresses, you prevent unauthorized individuals or bots from gaining access to the WordPress administrative area. IP allowlisting can restrict WordPress administration access to approved IP addresses. Before using IP allowlisting, check whether legitimate users connect from changing or unpredictable IP addresses.
Consider network segmentation, which divides your network into smaller parts. By segmenting the network (for instance, with a web application firewall), you can separate different components of your WordPress infrastructure, such as the web server, database server, and application server. Segmentation can limit which other systems an attacker can reach after one component is compromised.
Encryption can protect sensitive stored data from unauthorized access. Encryption converts data into a form that requires the correct key to read. Encryption can prevent someone without the required key from reading the protected data.
Access management controls allow you to define who can access your WordPress website and what level of access they have. By properly assigning roles, you can limit access to critical functions and sensitive areas of your website. For example, you can have administrators who have full control over the site, editors who can manage content, and subscribers who have only basic access. Access controls let administrators specify which users can access particular WordPress functions and resources.
Yes, implementing basic security practices like using strong passwords, keeping WordPress updated, and enabling two-factor authentication can be done without extensive technical knowledge. However, for more advanced security measures, it is advisable to seek assistance from a professional.
Regular updates install security fixes included in new WordPress, theme, and plugin releases. Update your WordPress installation, themes, and plugins as soon as new versions become available. Aim to check for updates at least once a week.
Before installing a free theme or plugin, check its source, update history, reviews, and support status. Stick to reputable sources like the official WordPress repository or trusted third-party marketplaces. Always review user ratings, read reviews, and ensure they receive regular updates and support.
If your WordPress website is hacked, take immediate action. Change all passwords, restore your website from a recent backup, and scan your site for malware using security plugins. Consider consulting with a professional to ensure all vulnerabilities are addressed.
Security plugins should be used alongside measures such as software updates, access controls, backups, and secure hosting. Use security plugins alongside regular updates, unique passwords, and appropriate hosting security controls.
Securing your WordPress site involves an ongoing effort and frequent upgrades. This includes keeping WordPress updated and restricting administrative access where appropriate. Organizations may also need controls for network access, authentication, and segmentation.
NordLayer provides controls that can restrict access to WordPress administration and related resources. One of the features we offer is IP allowlisting, which enables organizations to control access to internal resources by specifying trusted IP addresses. NordLayer also provides dedicated IP addresses that organizations can add to IP allowlists.
NordLayer also supports network segmentation Network segmentation can restrict lateral movement between separated parts of the network. We also offer the ability to provide exclusive access rights for those who specifically need to access your WordPress work environment.
NordLayer supports two-factor authentication (2FA) for user authentication. With 2FA enabled, users must provide another verification factor in addition to their login credentials.
Contact NordLayer to discuss access controls for your WordPress environment.
Anastasiya Novikava
Cybersecurity Copywriter
Anastasiya is a cybersecurity copywriter with a decade of experience in content marketing. She creates product comparisons, threat research and statistics, white papers, customer case studies, and educational content, with a focus on AI threats, data breach prevention, and compliance frameworks (DORA, GDPR, NIS2).
Subscribe to our blog updates for in-depth perspectives on cybersecurity.
