WordPress itself is secure when it is kept up to date. Most compromised WordPress sites are broken into through an outdated plugin, a weak or reused administrator password, or an abandoned theme, not through WordPress core. Updating everything, deleting what you do not use, and protecting the login page closes the common ways in.
We look after WordPress sites that carry real business, including a Phoenix criminal defense firm's site with more than 550 blog posts. Owners ask us the same thing every few months, usually after reading an alarming headline: is WordPress safe to run a business on.
Our answer is yes, with a condition. WordPress is safe the way a building is safe. The structure is sound. What matters is whether someone locks the doors and replaces the broken window.
This post covers where the real risk sits, the order we would fix things in, and when the better answer is to stop running WordPress at all.
Is WordPress core secure?
WordPress core, the software published by the WordPress project itself, is secure when it is kept current. It has a dedicated security team, a public process for reporting flaws, and automatic background updates for security releases. A break-in through an up to date copy of core is unusual compared with every other route.
Core is also some of the most examined code on the web. It runs on an enormous number of sites, so researchers and attackers both read it closely, and holes that are found get patched and pushed out quickly.
The trouble starts with everything added on top. A typical business site runs core plus a theme plus a few dozen plugins, each written by a different author with a different level of care. Core is one program. The rest is the attack surface.
What actually gets WordPress sites hacked?
Most compromised WordPress sites are broken into through something added to core or through the login page: an outdated plugin with a known flaw, a weak or reused administrator password, an abandoned theme, or a neglected hosting account. Attacks are automated. Nobody picked your site. A script found an open door.
| Way in | Why it works | What closes it |
|---|---|---|
| Outdated plugin | The flaw is public the day the fix ships, and scripts scan for sites that have not updated | Update promptly, remove plugins you do not need |
| Weak or reused password | Login pages are guessed at constantly, and leaked passwords get tried everywhere | Unique passwords, two-factor sign-in |
| Abandoned theme or plugin | The author stopped shipping fixes, so a known hole stays open forever | Replace anything that is no longer maintained |
| Deactivated but installed code | Files still sit on the server and can still be requested | Delete, do not just deactivate |
| Too many administrators | Every admin account is a full set of keys | Give writers the Editor role |
| Pirated premium plugins | Free copies of paid plugins often arrive with a backdoor included | Buy the license or go without |
Notice what is missing from that table: clever attacks on WordPress itself. The causes are maintenance problems, which is good news, because maintenance is something you control.
How do you harden a WordPress site?
Harden a WordPress site by shrinking what can be attacked and then protecting what is left: update everything, delete what you do not use, lock down logins, limit administrator accounts, and keep a tested backup. The steps below are in the order we would do them on a site we had just taken over.
- Update core, plugins, and themes. Then turn on automatic updates for anything you trust to update itself.
- Delete inactive plugins and themes. Keep one default theme as a fallback and remove the rest.
- Replace anything abandoned. If a plugin has not shipped an update in a long time, find a maintained alternative or replace it with a few lines of code.
- Fix the passwords. Every account gets a long, unique password from a password manager.
- Add two-factor sign-in for administrators. A stolen password alone should not be enough.
- Cut the administrator list. Remove former staff and old vendors. People who only write get the Editor or Author role.
- Give scripts their own credentials. WordPress has application passwords for this, so an automation never holds a person's real login and can be revoked on its own.
- Turn off the dashboard file editor. It lets anyone with an admin login rewrite code from the browser.
- Put the site behind a service that filters traffic. A CDN or firewall in front of the server can limit login attempts before they reach WordPress.
- Back up off-site and test the restore. We cover the method in how to back up a website properly.
Step eight is one line in wp-config.php:
define('DISALLOW_FILE_EDIT', true);Most of this list costs nothing but attention. The first pass is the long one. After that it is routine upkeep.
Does a security plugin make WordPress safe?
A security plugin helps, but it does not make a neglected site safe. It can limit login attempts, watch for changed files, and block known bad requests. It cannot repair an outdated plugin with a hole in it, and it is itself one more plugin that has to be kept updated.
We think of a security plugin as a smoke alarm. It is worth having, and it does not replace wiring the house properly. A site with ten well maintained plugins and no security plugin is in better shape than a site with sixty stale ones and three security plugins arguing with each other.
The basics that apply to every site, WordPress or not, are in our guide to website security basics.
When is it safer to leave WordPress altogether?
Leaving WordPress is the safer choice when nobody publishes often enough to need a dashboard. A static site has no login page, no database, and no plugins, so the common attacks have nothing to aim at. The trade-off is that edits go through a developer or a build step.
We made that move for a realtor's site. The goal was to retire WordPress and its database completely while keeping every page and article at its exact original address. There is no longer anything on the server to attack, and nothing to patch.
That is not the right call for everyone. A site built around more than 550 blog posts belongs on WordPress, maintained properly. We explain how we choose in WordPress or a static site.
Frequently asked questions
Is WordPress less secure than other website platforms?
Not inherently. WordPress is attacked more often because it runs so many sites, which makes automated attacks worth writing. A hosted website builder removes most of the maintenance from your hands, which helps if nobody is going to do that maintenance. A maintained WordPress site is not a weak one.
How often should WordPress plugins be updated?
Check at least weekly, and apply security releases as soon as they appear. The risky window is the gap between a fix being published and your site receiving it, because the fix itself tells attackers where the hole was. Automatic updates close that gap for plugins you trust.
Are free plugins less safe than paid ones?
Price is not the signal. Maintenance is. A free plugin with an active author and frequent releases is safer than a paid one that was last touched years ago. Look at the date of the last update, how quickly reported problems get answered, and whether the plugin does one job or twenty.
How do I know if my WordPress site has been hacked?
Common signs are administrator accounts you did not create, visitors being redirected to other sites, pages in search results that you never wrote, and warnings from your host or from Google Search Console. If you see any of them, change every password and call someone before deleting anything.
Should I rename or hide the WordPress login page?
It cuts down automated guessing, so it is harmless and mildly useful. It is not protection by itself. Strong passwords and two-factor sign-in are what stop a break-in.
If you are not sure what state your site is in, send us the address and we will tell you plainly what we would fix first.