WordPress runs a huge chunk of the internet, which also makes it a favorite target for automated attacks. Most of these aren’t sophisticated at all, they’re bots scanning for the obvious stuff: default settings, outdated software, weak passwords. A bit of setup work closes most of that door before it’s ever tested.

1. Avoid easy-to-guess usernames and passwords

Sites still running with “admin,” “siteadmin,” “administrator,” or any close variant as the username are handing attackers half the puzzle already, they only need to guess the password. The same goes for usernames or passwords built around your brand name, your own name, or whoever’s seen as the person in charge, those are usually the first things an attacker tries. Pick something that isn’t tied to your site’s public identity at all, and pair it with an actual strong, unique password, not something reused from another account. A password manager makes that painless to enforce for every account with access to your site, not just yours.

2. Consider two-factor authentication

Even a strong password can leak through phishing or a breach somewhere else entirely, and two-factor stops most automated login attempts dead. It’s not a must for every site, plenty of people find the extra step at login a hassle, and will skip it if forced. But for anything handling client data or payments, it’s worth the friction, and free plugins make it painless enough to set up.

3. Keep a second admin account

A single admin account is a single point of failure. Lose access to it, whether it’s a forgotten password, a locked email recovery address, or the account getting compromised, and you can end up locked out of your own site with no clean way back in. A second admin account, with its own separate login and its own 2FA if you’re using it, gives you a real way back in if the first one ever fails. It also matters the moment more than one person touches the site: shared logins make it impossible to tell who actually did what, and that’s exactly when something breaks or gets changed without explanation.

4. Keep everything updated, core, themes, plugins

Most WordPress compromises trace straight back to outdated software with a published, known vulnerability. Turn on automatic updates for minor releases, and actually check in on major ones.

5. Delete what you’re not using

An inactive plugin or theme can still be a vulnerability if its files are sitting on your server. Delete it, don’t just deactivate it.

6. Limit login attempts

Without a limit, someone can just keep guessing passwords forever. A free login-limiting plugin locks out an IP after a set number of failures, which shuts down brute-force attacks completely.

7. Check your file permissions

Overly loose file and folder permissions make it easier for malicious code to get written to your server if any other vulnerability gets exploited. Most hosts default sensibly, but it’s worth confirming, especially if you’re self-managing.

8. Turn off file editing from the dashboard

By default, WordPress lets theme and plugin files be edited directly from the admin dashboard. If someone ever gets admin access, that’s a direct line to injecting malicious code. Turn it off, one less avenue of damage if an account ever gets compromised.

9. Get a security plugin with a firewall

A web application firewall filters out malicious traffic before it hits your site. Several free options give you solid baseline protection, basic firewall rules and malware scanning included, and that’s a fine place to start before you ever consider paying for more.

10. Set up automated backups

Hardening reduces your risk. It doesn’t erase it. If something does get through, a recent backup is what turns a disaster into a Tuesday. Set up automated, offsite backups, stored somewhere other than the same server your site lives on, on day one, not after something’s already gone wrong.

Do it now, not later

Every item here takes minutes on a fresh install and a lot longer to clean up after an attack. Bake this into your standard setup instead of treating it as an afterthought, and your site quietly deflects the constant background noise that every WordPress site attracts, instead of becoming the example everyone else learns from.