WordPress runs a large share of the world’s websites, and that popularity is exactly why it draws so much attention from attackers. The reassuring part is that most attacks are automated and opportunistic. They are not expert hackers singling out your business by name. They are scripts that sweep the web looking for the same handful of avoidable weaknesses, and they move on the moment a site looks like hard work.

This guide is written for small business owners, not developers. It works through everything you need to keep a WordPress site secure, in plain English, from the five-minute basics to a few more technical steps worth knowing. Follow it from the top and your site becomes a far harder target than most.

Why WordPress sites get attacked

Attackers rarely care who you are. They care that WordPress is everywhere, which makes it worth writing a single automated tool that can try millions of sites at once. Those tools look for out-of-date software, weak passwords and known plugin flaws, then exploit whatever they find. A hacked site might be used to send spam, host scam pages, mine cryptocurrency or attack other sites, often without you noticing for weeks.

The good news is that the same predictability works in your favour. Because the attacks are formulaic, the defences are too. Close the common gaps and you are protected against the overwhelming majority of what is out there. Here is how, step by step.

1. Keep WordPress, themes and plugins updated

Out-of-date software is the single most common way sites get hacked. Every core release, theme update and plugin update routinely patches security holes, and once a fix is published, attackers know exactly what to look for on sites that have not applied it. An unpatched site is a known, advertised weakness.

Turn on automatic updates for minor WordPress core releases, which are almost always safe. Review plugin and theme updates at least weekly, and apply them promptly. If you are nervous about a big update breaking something, test it on a staging copy first, then update the live site. And if a plugin has not been touched by its developer in over a year, treat that as a warning sign and look for a maintained alternative.

2. Lock down your logins

Weak and reused passwords are the open door attackers hope to find. Automated tools guess thousands of common passwords a minute, so “password123” or your business name offers no protection at all.

Give every account a long, unique password, ideally a random string from a password manager so you never have to remember or reuse it. Avoid the default “admin” username, since it hands attackers half of the login for free. If you already have an “admin” account, create a new administrator with a different name, then remove the old one. These two changes alone stop most automated attacks.

3. Add two-factor authentication

Even a strong password can be phished, guessed or leaked in a breach of some other service where it was reused. Two-factor authentication closes that gap by asking for a second proof of identity at login, usually a short code from an app on your phone. A stolen password on its own is then useless.

Enable two-factor authentication on every administrator account, and encourage editors and other trusted users to do the same. Most reputable security plugins add it in a few clicks, and the small daily inconvenience is nothing next to the cost of losing your site.

4. Stop brute-force attacks

A brute-force attack simply tries password after password until one works. By default, WordPress lets it keep trying forever. Capping the number of failed attempts and locking out repeat offenders shuts the technique down cold.

A good security plugin will limit login attempts, add a short delay after failures and block persistent IP addresses automatically. It is also worth protecting the login page itself, for example with a simple challenge on the form, so bots cannot hammer it around the clock.

5. Choose themes and plugins carefully

Plugins and themes are what make WordPress so flexible, but every one you add is another piece of code that could contain a flaw. Fewer, well-chosen extensions mean a smaller attack surface and a site that is easier to keep secure.

Before installing anything, check the reviews, the number of active installs and when it was last updated. Stick to reputable sources such as the official WordPress directory or established commercial developers. Never use “nulled” or pirated premium plugins, which are a classic way to smuggle malware onto a site. Finally, delete anything you are not actively using, because even a deactivated plugin can be exploited if its files remain.

6. Encrypt everything with HTTPS

An SSL certificate encrypts the connection between your visitors and your site, so logins, contact form entries and anything else people type cannot be read in transit. It also shows the reassuring padlock in the browser, and search engines treat HTTPS as a ranking signal, so it helps your visibility too.

There is no longer any reason to run a site without it. Every Lucid Cloud Platform plan includes free SSL, so switching your site to HTTPS is quick and costs nothing. Once it is active, make sure the whole site redirects to the secure address so no page is left on plain HTTP.

7. Back up regularly, and test your restores

Security is about recovery as much as prevention. No defence is perfect, so the question is not only how to keep attackers out, but how quickly you could recover if one got in. A recent backup turns a potential disaster into a five-minute fix.

Automate daily backups of both your files and your database, and keep copies somewhere separate from the site itself, so a compromised server does not take your backups with it. Just as importantly, test a restore occasionally. A backup you have never restored is only a promise, and you want to discover any problem before you actually need it. Hosting that includes automated off-site backups takes this worry off your plate entirely.

8. Give people only the access they need

Not everyone who works on your site needs to be an administrator. WordPress has built-in roles for a reason: an editor can manage content without touching site settings, and an author or contributor can write posts without any wider access. Handing out administrator rights freely means every one of those accounts becomes a potential way in.

Give each person the least access that lets them do their job, and review your user list from time to time. Remove accounts for freelancers, former staff or old integrations you no longer use. Every account you close is one fewer that can be compromised.

9. Add a security layer

A web application firewall, or a trusted all-in-one security plugin, sits in front of your site and blocks known bad traffic before it ever reaches WordPress. It can filter out common attack patterns, scan for malware, watch for unexpected changes to your files and alert you the moment something looks wrong. Think of it as a smoke alarm for your website.

You do not need several overlapping tools. One well-regarded security plugin, kept up to date and actually configured rather than left on defaults, covers most small business sites comfortably.

10. Harden the foundations

A few slightly more technical tweaks close the gaps that automated tools probe for. None of these require you to be a developer, and many security plugins can apply them for you:

Disable the built-in file editor so that even if an admin account is compromised, an attacker cannot edit your theme and plugin code from inside the dashboard.
Set sensible file permissions, so that core files cannot be altered by the web server unless they need to be.
Protect the wp-config.php file, which holds your database credentials and security keys, from being read.
Remove version numbers that broadcast exactly which release of WordPress, themes or plugins you are running, so attackers cannot shop for a matching exploit.

These are the kind of protections that good managed hosting often applies at the server level, so you may already have several in place without realising it.

Security starts with your host

Where your site lives makes a real difference to how safe it is. Cheap, crowded hosting can let a problem on one site spill over to its neighbours, and often leaves the security work entirely to you. Good managed hosting does much of the heavy lifting: server-level firewalls, account isolation, automatic SSL, malware scanning and regular off-site backups, all maintained for you.

With Lucid Cloud Platform, a lot of the list above is built in, so you can spend less time worrying about threats and more time running your business. Security is never something you can fully outsource, but the right foundation means you are protecting a house that was built well in the first place.

What to do if your site is hacked

If the worst happens, stay calm and work methodically. Panicking and deleting things at random usually makes recovery harder.

Put the site into maintenance mode or take it offline, so visitors are not exposed to anything harmful while you work.
Restore from a clean backup taken before the compromise, if you have one. This is the fastest way back to a known-good state.
Change every password: your WordPress accounts, hosting control panel, database and any connected services. Assume anything the attacker could see has been seen.
Update everything and remove any plugin or theme you do not recognise or no longer need.
Scan for malware with a reputable security tool, and ask your host for help. A good support team deals with this regularly and can often spot what you cannot.

Your quick-start checklist

If you do nothing else this week, do these:

Turn on automatic updates and apply any that are pending.
Replace weak or reused passwords, and retire the “admin” username.
Enable two-factor authentication on every administrator account.
Confirm your site is fully on HTTPS.
Check that automated backups are running, and that you know how to restore one.
Install and properly configure one trusted security plugin.

Security is layered, not a single switch, and you do not have to do everything at once. Start at the top of this guide and work down. Every step you take makes your site a harder target, and most attackers, faced with a little resistance, simply move on to an easier one.

The full WordPress security series

This guide is the hub of a four-part series. Once you have the basics in place, these companion articles go deeper on the areas that matter most:

News & Articles

The complete WordPress security guide for small businesses