A security checklist for your WordPress site
Eight quick habits that shut the door on the most common attacks.
- Keep WordPress, themes and plugins updated.
- Use a long unique admin password and turn on two-factor login.
- Limit login attempts with a security plugin.
- Remove inactive users and give each editor only the role they need.
- Disable file editing by adding
define('DISALLOW_FILE_EDIT', true);to wp-config.php. - Install only plugins from trusted sources.
- Keep automatic backups.
- Use HTTPS on the whole site.
Tip: Download themes only from the official directory or the author. Nulled copies often contain hidden backdoors.
