Blog / security monday
The five WordPress security habits that stop most hacks
The five habits we see separating clean WordPress sites from hacked ones on our servers, and how to make each one part of your routine.
We have been hosting WordPress sites since the software was new, and the pattern behind compromised sites has barely changed in that time. Almost every cleanup we do traces back to one of a handful of missed basics. Not exotic attacks. Not determined hackers targeting one business. Just automated scripts finding the same open doors, over and over.
So we are starting a Security Monday series with the five habits that would have prevented most of the hacked sites we have ever cleaned up.
Update the software, all of it
WordPress core, themes, plugins. When a plugin vulnerability is published, automated scanners start probing for it within days, sometimes hours. The sites that get caught are the ones still running the old version weeks later.
Turn on automatic updates for minor WordPress releases. Log in once a week and update plugins and themes. If a plugin has not been updated by its author in over a year, treat that as a warning sign and look for a replacement.
Ten minutes a week. That is the whole habit.
Use a real admin password, and add a second factor
Attackers do not guess passwords one at a time like in the movies. They run lists of millions of leaked passwords against your login page and every other login page on the internet. If your admin password appears in any breach anywhere, assume it will be tried against your site.
Use a password manager and let it generate something long and random. Then add two-factor authentication with any reputable plugin, so a stolen password alone is not enough. While you are at it, make sure your account is not named "admin". That is still the first username every bot tries.
Run fewer plugins
Every plugin is code written by someone else, running with full access to your site. Some are excellent. Some were abandoned years ago and nobody noticed.
On our shared hosting servers, the sites that get compromised repeatedly are almost always the ones running thirty or forty plugins, including several doing nothing. Deactivated plugins still count: the code is still on disk and still reachable. If you are not using it, delete it.
A good target is this: for each plugin, you can say in one sentence what it does and why you need it. If you cannot, remove it and see what breaks. Usually nothing does.
Keep a backup that lives somewhere else
A backup is not a security measure in the prevention sense, but it changes what a hack costs you. With a clean backup from last week, a compromise is an annoying afternoon. Without one, it can mean rebuilding the site from memory.
Keep at least one backup that lives somewhere other than the site itself. A backup stored inside the same hosting account can be encrypted or deleted by the same attacker who got into the site. We keep server-side backups for our customers, but we still tell everyone to run their own as well. Two independent copies made by two different systems is the setup that has never let anyone down.
Protect the login page
The single noisiest thing on any WordPress server is bots hammering wp-login.php. Most of it is harmless background noise, but it only stays harmless if the door holds.
Limit login attempts so an IP gets blocked after a few failures. If only you and one or two people ever log in, consider restricting the login page by IP address or putting a second password in front of it at the server level. Any of these turns the endless password-list attack from a real risk into wasted bot traffic.
Where to start
If you do nothing else this week, do the first two: bring everything up to date and turn on two-factor authentication. Those alone would have prevented the majority of the compromised sites we have handled.
We will keep this series going with one practical topic each month. And if you are on our servers and something about your site already looks wrong, do not wait for next Monday: open a ticket with our support team and we will look at it with you.