Table of Contents
Most WordPress hacks don't target a specific business — automated bots scan the web looking for outdated software and weak passwords. Fixing the basics below removes you from that easy target list.
1. Keep WordPress, themes and plugins updated
Most breaches exploit a known vulnerability in outdated software. Turning on automatic updates for minor releases closes this gap with almost no effort.
2. Use strong, unique login credentials
Never use "admin" as your username, and use a unique, randomly generated password stored in a password manager rather than something memorable.
3. Add two-factor authentication
A free plugin like WP 2FA adds a second login step, so a stolen password alone isn't enough to get into your dashboard.
4. Limit login attempts
Plugins like Limit Login Attempts Reloaded block an IP address after a handful of failed logins, stopping automated password-guessing attacks.
5. Install an SSL certificate
SSL encrypts data moving between your visitors and your server. Most hosts, including Vikalink, offer this free — there's no reason to skip it.
6. Take regular backups
If something does go wrong, a recent backup turns a disaster into a ten-minute restore. Store backups off-server, not just on the same hosting account.
Key takeaway: Security is cumulative — no single step makes a site unhackable, but stacking updates, strong logins, 2FA and backups together removes almost all of the easy attack paths.
7. Use a web application firewall
A WAF like Wordfence or Sucuri filters malicious traffic before it ever reaches WordPress itself, blocking common attack patterns — SQL injection attempts, known bad IP ranges, brute-force login floods — at the edge rather than relying on WordPress to defend itself.
8. Disable file editing from wp-admin
By default, an administrator can edit theme and plugin files directly from the dashboard. If an attacker ever gains admin access, that same editor becomes their easiest route to planting malicious code. Adding define('DISALLOW_FILE_EDIT', true); to wp-config.php closes that door.
9. Scan for malware regularly
A security plugin's scanner catching a compromise within a day is a minor inconvenience. The same compromise left undetected for months can get your entire domain blacklisted by Google and hosting providers alike, which is far harder to undo.
10. Set correct file and folder permissions
WordPress folders should generally be set to 755 and files to 644, with wp-config.php locked down further to 440 or 400 where your host allows it. Overly permissive settings — 777 is the common culprit — let any compromised script on shared hosting write to your files directly, turning a small breach elsewhere into a full site takeover.
How often should you review this checklist?
Revisit it any time you add a new plugin, take on a new site administrator, or roughly every six months regardless — security is not a one-time setup, and a site that was secure last year isn't guaranteed to be secure today.
Frequently asked questions
Is WordPress security a one-time setup or an ongoing task?
Ongoing. New vulnerabilities are disclosed in plugins and themes every week, so a site that passed every check on this list six months ago can still have an outdated component today. Treat this checklist as a recurring review, not a box you tick once.
What's the single most important step on this list?
Keeping WordPress core, themes, and plugins updated. The overwhelming majority of WordPress hacks exploit a vulnerability that was already patched in a newer release — the site just hadn't updated yet.
Do I still need a security plugin if my host offers a firewall?
Usually yes. A host-level firewall filters traffic before it reaches your server, but a WordPress security plugin adds site-specific protection — malware scanning, login hardening, file-change alerts — that operates at a different layer and catches different problems.