You read that WordPress sites are often hacked, or you receive a notification from your hosting provider or Wordfence, and you have no idea where to start. WordPress security is based on five layers: keeping the core, themes, and plugins up to date; using strong passwords with two-factor authentication; a firewall; daily backups; and monitoring for malware and login attempts. Together, they prevent the vast majority of hacks we encounter in practice. Below, I’ll walk you through what to do for each layer, the order in which to tackle them, and what to do if things do go wrong.
Why WordPress Sites Are Targeted
WordPress sites are targeted because WordPress is the most widely used CMS in the world, which makes it worthwhile for attackers to automatically scan them for vulnerabilities. This scanning is done by bots, not people. Day and night, they scan thousands of sites looking for a plugin with a known vulnerability or a login screen with a weak password. So it’s rarely about your company specifically, and that works in your favor. A bot looks for easy prey, so if you’ve got the basics in order, you’re quickly ruled out. Customers sometimes ask me if that means WordPress is simply insecure. My answer is always the same: WordPress itself isn’t insecure—poor maintenance is.
The most common WordPress issues that lead to a hack are outdated plugins, weak or reused passwords, and illegally copied (nulled) themes that already contain a backdoor. If you want to know exactly how each of these entry points works, read The 7 Causes of a WordPress Hack.
The Five Layers of WordPress Security
The best way to secure WordPress is like securing a house, with multiple layers, each handling a different aspect. A good lock on the door keeps most burglars out, but you also want an alarm, a camera, and insurance in case things do go wrong. Updates and strong passwords are your locks, the firewall is your alarm, monitoring is your camera, and the backup is your insurance. One layer is never enough, because each layer has a blind spot that the next layer covers. Moreover, those five layers rest on a foundation: hosting that secures the server itself. You can read more about what to expect from each of these in the section below, which explains who handles what.
Layer 1: Updates to the core, themes, and plugins
Updates patch known vulnerabilities, and most vulnerabilities in WordPress are found in plugins. As soon as a vulnerability is made public (often with a CVE number), it’s listed in databases like WPScan and Patchstack, and bots start searching for it specifically. Delaying updates is therefore the biggest risk I see. My advice is to check for updates weekly and, for an online store, to first test them on a staging environment, and to completely remove plugins and themes you don't use, rather than just deactivating them. A deactivated plugin is still on your server and can still be exploited.
Your PHP version is also part of this layer. Choose a version that still receives security updates on php.net. On our shared hosting, you can set a version between PHP 7.4 and 8.5 yourself via cPanel > Select PHP Version. Want to read more? See Updating WordPress Safely, Clean up outdated plugins, Monitoring vulnerabilities in plugins, Why You Should Never Use Nulled Themes and Update PHP Version.
Layer 2: Passwords, two-step verification, and user roles
Access security ensures that only the right people can log in to the right place. Start by using a unique password for each account from a password manager, and enable two-factor authentication (2FA) for everyone with administrator privileges. With 2FA, a stolen password alone isn’t enough for an attacker. In addition, limit the number of login attempts so that a brute-force attack (a bot trying thousands of passwords in succession) gets stuck. Something I still regularly come across during audits are accounts with the username “admin” and former employees who are still listed as administrators. Assign the administrator role only to those who actually manage the site.
Don’t forget about security outside of WordPress. Your hosting control panel also deserves 2FA, and for files, use SFTP instead of regular FTP. Turn off XML-RPC if you’re not using it. Don’t disable the REST API entirely—the block editor needs it—but you can prevent usernames from being exposed via that API. And be careful phishing emails that ask for your login credentials, because sometimes they're almost indistinguishable from the real thing. You can read more at Securing Your WordPress Login, password managers and secure passwords and User Roles in WordPress.
Layer 3: firewall (WAF)
A firewall (WAF) blocks malicious traffic before it reaches your website. You can deploy it at three levels: on the server, via a proxy such as Cloudflare, or as a WordPress plugin. The difference lies in the point at which filtering takes place. A server firewall stops an attack before WordPress loads, while a plugin firewall only intervenes once WordPress is already running—meaning the attack is already consuming server resources. That’s why I believe a firewall belongs on the server, not just in a plugin.
Security plugins such as Wordfence, Sucuri, or Solid Security can be useful additions. They excel at 2FA, limiting login attempts, and checking whether files have been modified. DDoS protection, however—which involves mitigating a flood of traffic—really belongs at the server or proxy level. You can read more about this trade-off in server-level firewall or plugin.
Layer 4: Backups as a safety net
A backup won’t prevent a hack, but it determines how quickly you’ll be back online. This only works if the backup is created automatically and daily, is stored off-site, and covers several days. An infection can be lurking on your site for days before you notice it, and in that case, yesterday’s backup alone won’t be enough. Also, test every now and then to make sure the restore process actually works—preferably before you need it.
I have one piece of advice for everyone. Restoring a backup without fixing the root cause means you’ll be hacked again before long, because the vulnerability is still there. You can read about how to choose the frequency and how the restoration process works in how often you back up your data and Restore a backup.
Layer 5: Monitoring for malware and login attempts
Monitoring ensures that you detect a hack within hours rather than weeks. The sooner you notice it, the less damage there will be and the lower the chance that Google will place a warning on your site. These are the signs I keep an eye on.
- Malware scans of files and databases.
- Failed login attempts and new administrators you don't know.
- Modified core files.
- An activity log that records who installs plugins or changes roles.
- Uptime, or whether your site is accessible.
Underneath all these layers lies another basic requirement: HTTPS via an SSL certificate. With us, this is free through Let’s Encrypt and is automatically renewed as long as your DNS points to Surver. See SSL Certificate and HTTPS.
Securing WordPress: Start with These Seven Steps
Checking off twenty security tips is less valuable than implementing five layers that actually work. Start with updates, two-step verification, and a backup you can restore; the rest is just a bonus. If you only have an hour today, I’d do it in this order.
- Make a backup, and then install all the updates.
- Remove plugins and themes that you don't use.
- Enable two-step verification for all administrators.
- Review the administrator accounts, delete any unknown accounts, and restrict roles that are too broad.
- Verify that daily backups are stored off-site and that the restore process works.
- Check to see if your hosting provider offers a firewall and malware scans.
- Disable file editing in the dashboard using
define('DISALLOW_FILE_EDIT', true);inwp-config.php.
If you're a bit more tech-savvy, you can take it a step further. Set the file permissions to 644 for files and 755 for folders, so that not everyone on the server can write to everything. Also, block the execution of PHP in the folder wp-content/uploads. That directory is only supposed to contain images and documents, so a PHP file in that location is almost always suspicious.
Hiding your WordPress version or changing the database prefix isn't as effective as you might think. It doesn't hurt to do it, but bots simply try known vulnerabilities without first checking your version number. I'd rather you spend that time on the seven steps listed above.
Who handles what: hosting, maintenance, or you?
Hosting secures the server, but not what you install on your site yourself. I often come across this misunderstanding. People assume that the hosting provider covers everything, when in fact an outdated plugin or a shared password is entirely your responsibility. Good Managed WordPress Hosting handles the server-side aspects, such as the firewall, malware scans, isolation between accounts, and backups. The table shows how these tasks are divided at Surver.
| Low | Surver Hosting (all shared hosting plans) | WordPress Maintenance and Management | You yourself |
|---|---|---|---|
| Updates | Server software and PHP patches | Monthly updates for the core, themes, and plugins | What you install and whether you install updates |
| Access | Captcha page after more than ten failed login attempts, 2FA on my.surver.nl and cPanel | Starting with Business Login Protection with 2FA | Passwords, who has access, what role |
| Firewall | ModSecurity firewall, Bot Blocker, DDoS protection | Starting with the Business plan, a site-level WAF | Possibly an additional plugin |
| Backups | Daily backups on separate servers within Europe, restored via JetBackup 5 | At Enterprise, updates are first tested on the staging environment | Test whether the rollback works |
| Monitoring | Imunify malware scans, isolation with CloudLinux and CageFS | Uptimecheck every minute; starting with the Business plan, a daily vulnerability scan and activity log | Spotting Unknown Administrators and Suspicious Content |
At Surver, we make it standard practice for every shared hosting package to secure the server side as much as possible. A ModSecurity firewall and DDoS protection block most malicious traffic before it reaches your site. Imunify scans for every file change and immediately locks any suspicious file; after more than ten failed login attempts—including on wp-admin—the IP address is redirected to a CAPTCHA page. As a customer, you usually won’t notice any of this, and that’s exactly the point. What we can’t do for you with hosting alone is update your plugins or determine who the administrator is. If you’d like to outsource that as well, it falls under WordPress Management. Starting with the Business plan, it also includes a WAF, a vulnerability scanner, login protection with 2FA, and an activity log. On Surver Cloud, it works a little differently, with a malware scanner and a site firewall, plus optional ModSecurity or Cloudflare.
Special Focus on a WooCommerce Online Store
A WooCommerce online store requires more security than a regular website because you store personal data such as customer accounts, addresses, and orders. Always process payments through a payment provider like Mollie so that card information never ends up on your own site. Require two-factor authentication (2FA) for everyone who has access to orders—including the colleague who only ships packages—and back up your data more frequently than you would for an informational website. Every order contains data you don’t want to lose. You can find instructions on how to set this up in Securing WooCommerce. If you'd prefer to have someone else handle the updates and maintenance for your store, check out WooCommerce maintenance.
If things do go wrong: recognize, correct, and report
You can recognize a hacked site by unfamiliar administrators, redirects to spam, a warning from Google or your browser, or a notification from your hosting provider. If you notice any of these signs, don’t panic—just follow these steps. You can read about what to do in the first hour—such as changing passwords and preserving evidence—in My WordPress website was hacked—what should I do now?.
Next comes the cleanup, and that's where things often go wrong. Restoring a backup isn't enough, because attackers leave behind backdoors that may also be present in your backups. I describe how to detect them in Removing Malware from WordPress. If that's too technical for you, you can have the cleaning and repair of the cause done through WordPress hacked.
If your site has a red warning in Google, request a review in Search Console after cleaning it up. You can read how to do that in Remove the Google warning. If personal data may have been accessed, you also have a legal obligation. You must report the data breach to the Dutch Data Protection Authority within 72 hours, and in some cases, you must also notify the individuals concerned. More on this in mandatory reporting of data breaches.
Security and the GDPR
The GDPR requires you to take appropriate technical measures to protect personal data, and the five layers outlined in this guide form the core of those measures. In addition, the law requires a few things that go beyond the technical aspects of your site. You must use HTTPS, have a data processing agreement with your hosting provider, and ensure your cookie banner requests genuine consent. We include this data processing agreement as standard—even for email hosting—and it’s available at surver.nl/juridisch/verwerkersovereenkomst/. You can set up the cookie banner yourself or as cookie module set it up. We use Complianz for this and configure it based on a few questions about your site.
If you want to know what else to look out for, read What the GDPR Requires from a Technical Perspective, Which cookie banner is required? and Implementing Cookiebot Without a Plugin. This is a practical explanation, not legal advice.
Security is an ongoing process, not a one-time task
You set up the five layers correctly once, but they’ll only continue to work if you keep them up to date. A plugin that’s secure today might have a known vulnerability next month, and a backup you never test is a gamble. My advice: Make sure to install your updates, check in with your administrators, and perform a test restore of your backup every month. You can find instructions on how to set up that routine in the maintenance checklist.
Frequently Asked Questions
Is WordPress secure?
Yes, the WordPress core is well-secured and receives updates quickly when a vulnerability is discovered. The risk almost always lies in outdated plugins, weak passwords, and neglected maintenance. With the five layers outlined in this guide, you can address those vulnerabilities.
Do I need a security plugin?
Not necessarily. If your site is hosted on Surver's shared hosting, a ModSecurity firewall and malware scans with Imunify are already set up on the server. A plugin would then serve as a supplement, which is especially useful for 2FA and limiting login attempts.
Should I change the WordPress login URL?
It's allowed, and it reduces traffic on the roads /wp-login.php, but it's not a security measure in and of itself. Two-factor authentication and a limit on login attempts are what really make a difference.
How often should I update WordPress?
Install security updates as soon as possible, especially if the vulnerability is already being actively exploited. Install other updates at least once a month, always after creating a fresh backup.
