WordPress is the number one target for hackers because it powers 43% of the web. But getting hacked isn't inevitable — 90% of attacks exploit known, easily preventable vulnerabilities. Not sophisticated zero-days. Not nation-state attacks. An unpatched plugin. A weak password. An outdated PHP version. Here are the 8 concrete measures that would have prevented almost every hack I've seen.
The 8 essential security measures
Measure 1 — Systematic updates
WordPress core, themes, plugins: this is the primary cause of hacks — and the most easily avoidable. Every update patches known vulnerabilities. An unpatched plugin is an open door publicly announced in the CVE database. Bots permanently scan the web looking for vulnerable versions. Enable automatic updates for WordPress core, update plugins at least weekly, and delete inactive plugins and themes — even deactivated ones can contain exploitable vulnerabilities.
Measure 2 — Admin username ≠ "admin"
Brute-force attacks test millions of username/password combinations. If your username is "admin" (the WordPress default on older installations), attackers have already solved half the puzzle. Change it to something unique and unguessable. Add a strong password (16+ characters, numbers, symbols) generated by a password manager like Bitwarden or 1Password.
Measure 3 — Two-factor authentication (2FA)
Even if your password is compromised (phishing, data breach from another service), 2FA blocks access. The attacker needs your phone as well as the password. Recommended plugins: WP 2FA (free) or Google Authenticator for WordPress. 5-minute setup. Mandatory for all editor/admin accounts, not just yours.
Measure 4 — Active security plugin (Wordfence)
Wordfence (free version) is the market standard: web application firewall (WAF) that blocks attacks before they reach WordPress, malware scanner comparing your files to WordPress originals, brute-force protection, real-time email alerts when a vulnerability is detected in your plugins.
Measure 5 — Automatic off-server backups
If your server is compromised, backups stored on the same server are compromised too. The golden rule: off-server backups, daily, with 30-day retention. Use UpdraftPlus (free) to automatically back up to Google Drive, Dropbox or S3. Test your restore process at least quarterly — an untested backup is a backup that won't work when you need it.
Measure 6 — SSL/HTTPS across your entire site
SSL is no longer optional — Google has penalised HTTP sites in rankings since 2018. Without HTTPS, data exchanged between visitors and your site travels in clear text. Passwords, payment card data, personal information — interceptable by anyone on the same Wi-Fi network. Your host typically provides a free Let's Encrypt certificate. Ensure your site forces HTTPS on all pages, not just login or payment pages.
Measure 7 — HTTP security headers
Security headers are server instructions to browsers preventing specific attack types. Addable in 5 minutes via .htaccess or a plugin like Headers Security Advanced & HSTS WP: X-Frame-Options (prevents clickjacking), Content-Security-Policy (blocks malicious script injection), Strict-Transport-Security (forces HTTPS), X-Content-Type-Options (prevents MIME-type sniffing). Check your headers free at securityheaders.com.
Measure 8 — PHP up to date (8.2+)
PHP is the server language powering WordPress. Outdated versions (PHP 7.x) haven't received security patches since end of 2022. In 2026, running PHP 7.4 means known, unpatched vulnerabilities. PHP 8.2 minimum, ideally 8.3. Check in WordPress Dashboard → Site Health. Update via your hosting control panel (cPanel, Plesk) in 2 clicks.
What your hosting provider actually does
Good hosts (SiteGround, Kinsta, WP Engine) protect the infrastructure: DDoS protection, daily server-level antivirus scanning, account isolation, network firewall, server-side backups (typically 7–30 days).
What they do NOT do:
- ❌ Update your plugins for you
- ❌ Check if your credentials are strong
- ❌ Configure your 2FA
- ❌ Detect malicious code injected into your theme/plugin files
- ❌ Alert you when a vulnerability is found in a plugin you're using
Your host protects the building. You're responsible for locking your own doors and windows.
Case study: hacked e-commerce site, Toulouse
Context: WooCommerce fashion e-commerce site, Toulouse. Contact form plugin unpatched for 14 months. Known SQL injection vulnerability, publicly documented in CVE — but the owner "hadn't had time" to run updates.
What happened: SQL injection via vulnerable plugin → database access → theft of customer data (emails, addresses, order history) → phishing script installation → Google blacklisting.
Consequences:
- ⏸️ 4 days offline (during remediation)
- 💸 €12,000 estimated revenue loss (average basket × normal orders over 4 days)
- 🔧 €3,800 remediation cost (cleanup, security hardening, audit, GDPR data breach notification)
- 📉 Google traffic divided by 3 for 6 weeks post-incident (blacklist penalty)
Cost if secured from the start: ~€500/year (maintenance + Wordfence premium + UpdraftPlus backups). The ROI of security is obvious.
FAQ — WordPress Security 2026
My hosting provider handles my WordPress security, right?
Partially. Your host protects server infrastructure: DDoS, account isolation, network antivirus scanning. But they don't manage application security — your plugins, theme, credentials, code. If one of your plugins has a known, unpatched vulnerability, your host won't fix it for you. SiteGround and Kinsta are excellent WordPress hosts — but they don't replace the 8 measures in this article.
Is Wordfence free enough for my WordPress site?
For most SME sites, yes — the free version includes a solid WAF, malware scanner and brute-force protection. The main limitation: firewall rules are updated with a 30-day delay (vs real-time for premium at $119/year). For e-commerce or high-traffic sites with sensitive data, premium is recommended. For portfolio or blog sites, free is more than sufficient.
How do I know if my WordPress site has been hacked?
Warning signs: Google blacklists your site ("This site may be dangerous" in Chrome), your host sends security alerts, your site redirects to unknown URLs, strange pages appear in Google Search Console, your host suspends your account for spam. Free diagnostic: Sucuri SiteCheck — enter your URL, full scan in 30 seconds with detailed report.
What to do if my WordPress site is hacked?
5-step emergency protocol: 1) Put the site in maintenance mode immediately to protect visitors. 2) Notify your host — some offer cleanup assistance. 3) Restore from your last clean off-server backup (this is why UpdraftPlus + Google Drive matters). 4) Change all passwords: WordPress admin, FTP, hosting, database. 5) Identify and fix the vulnerability before going back online — a cleaned site without fixing the breach will be re-hacked within 48 hours.
Protect your site before it's too late
Security audit + implementation of the 8 measures: I handle it for you. Less expensive than post-hack remediation.
Request a WordPress security audit