You have heard that WordPress sites get hacked all the time. Maybe a friend’s did. Maybe you are wondering, quietly, whether anyone is actually looking after yours.
Here is the part most people don’t know. In 2025, security researchers logged 11,334 new vulnerabilities in the WordPress world. Six were in WordPress itself.
Six.
The rest were in plugins and themes, the extras added to a site after it was built. That is good news. It means most WordPress security comes down to a handful of habits you can check today.
This WordPress security checklist covers them, plus exactly what to do if your site has already been hacked. If you would rather not think about any of it, our WordPress hosting and maintenance packages do it for you.
Is WordPress secure?
Yes. The core software is maintained by a large team, and security fixes are released quickly and installed automatically on most sites.
The risk sits around it.
Patchstack’s State of WordPress Security in 2026 report found that 91% of the vulnerabilities logged in 2025 were in plugins and 9% in themes, with only six in WordPress core. It also found that 46% weren’t fixed in time for public disclosure, and that the most heavily attacked were being exploited at scale within a median of five hours.
Five hours. For the flaws attackers want most, that is how long it typically took them to arrive once a flaw was known.
So the honest answer is that WordPress is as secure as the way it is looked after. A well-kept site is a hard target. A site built three years ago and never touched since is an easy one.
The WordPress security checklist at a glance
- Keep WordPress, plugins and themes updated.
- Delete the plugins and themes you don’t use.
- Only install plugins and themes from trusted sources.
- Use strong, unique passwords and two-factor authentication.
- Give each person the least access they need.
- Don’t have a user called “admin”.
- Turn off file editing in the dashboard.
- Run the whole site over HTTPS.
- Keep backups somewhere other than your server, and test that they restore.
- Put a firewall in front of the site.
- Use a host that keeps PHP and the server up to date.
- Protect your wp-config.php file.
- Watch for problems, so you hear about them first.
How to secure a WordPress site, step by step
Keep WordPress, plugins and themes updated
This one matters more than every other item put together. Updates are how security holes get closed.
WordPress has installed its own security releases automatically since version 3.7. Since version 5.5, you can switch on automatic updates for each plugin and theme from the dashboard.
Turn them on for anything simple. For anything your site depends on, like the shop, the booking system or the forms, update promptly and then check the site. Our guide to how to update WordPress plugins walks through doing it safely.
Delete the plugins and themes you don’t use
A deactivated plugin still sits on your server, and its code can still be attacked. Not using it? Delete it. The same goes for the spare themes WordPress installs by default: keep the one you use and one default theme as a fallback, and remove the rest.
Only install from trusted sources
WordPress.org’s own advice is to get plugins and themes from the official directory or from well-known companies. A “free” copy of a paid plugin from a download site is one of the oldest ways malware gets onto a website. It is never free.
Use strong passwords and two-factor authentication
Long, unique passwords for every account, kept in a password manager. Then add two-factor authentication, so a stolen password on its own isn’t enough to get in. WordPress.org recommends it, and it takes a plugin and five minutes to set up.
Give people the least access they need
WordPress has roles for a reason: Administrator, Editor, Author, Contributor and Subscriber. The person who writes your blog posts doesn’t need to install plugins. Your old web designer doesn’t need an account at all any more.
Open Users once a quarter. Anyone who shouldn’t be there, remove.
Don’t have a user called “admin”
It is the obvious guess for anyone trying to break in, and automated attacks guess it constantly. If your site still has one, create a new administrator with a different username, log in as that, and delete the old one, giving its content to the new account.
Turn off file editing in the dashboard
By default, an administrator can edit plugin and theme code from inside WordPress. If someone ever gets into that account, that is the first thing they will use. WordPress.org’s hardening guide recommends switching it off by adding one line to your wp-config.php file:
define( 'DISALLOW_FILE_EDIT', true );If you aren’t comfortable editing that file, ask your host or developer. It takes a minute.
Run the whole site over HTTPS
HTTPS encrypts everything between your visitors and your site, including your own login. Most hosts include a free certificate. If your address bar doesn’t show a padlock on every page, fix that first.
Keep off-site backups, and test them
A backup stored on the same server as the site can be lost along with it. Keep copies somewhere else, and keep several days’ worth, because a hack is often noticed days after it happened.
Then test one. A backup you have never restored is a hope, not a plan.
Put a firewall in front of the site
A web application firewall blocks known attacks before they reach WordPress. WordPress.org’s guide mentions security plugins, firewalls and services like Cloudflare and Sucuri. Some hosts include one as standard, so ask yours before paying twice.
Use hosting that keeps the server up to date
Your host runs the server, the database and the version of PHP your site runs on. Old versions stop getting security fixes. In your dashboard, go to Tools, then Site Health, and WordPress will tell you whether your PHP version needs updating. If your host can’t or won’t update it, that tells you something about the host.
Protect your wp-config.php file
This file holds your database password and your security keys. Guard it.
WordPress.org’s hardening guide suggests moving it one level above the site’s main folder where your host allows, or blocking access to it in your server settings. It also recommends standard file permissions: 755 for folders and 644 for files. Your host or developer can confirm both.
Watch for problems
You want to hear about a problem before your customers do. A security plugin can scan for changed files and email you. Google Search Console’s Security Issues report tells you if Google has found hacked content or malware on your site. Set both up now, while nothing is wrong.
Do you need a WordPress security plugin?
Usually, yes. A good security plugin adds the things WordPress doesn’t do on its own: a firewall, login protection, two-factor authentication, malware scans and alerts when files change.
Wordfence, Sucuri, Solid Security and Patchstack are among the best known. Pick one, not three. Several security plugins running at once tend to trip over each other and slow the site down. And a plugin is no substitute for the habits above: it can’t update your other plugins for you, or stop you reusing a password.
If your WordPress site has already been hacked
Then this checklist is for afterwards. First, you need the site clean.
The signs are usually one of these: Google showing “This site may be hacked” under your listing, visitors being redirected to spam, pages in Japanese or full of spam terms showing up under your domain, or administrators you don’t recognise. Don’t delete anything yet, and don’t create a new site.
Our step-by-step guide to fixing a hacked WordPress site covers what to do in the first hour, how to clean it, how to get Google’s warning removed, and the Japanese keyword hack we have cleaned off Irish business sites.
If customer data was exposed, the 72-hour rule
This is the part most WordPress guides leave out, and for an Irish business it matters.
If a hack exposed personal data, such as customer names, emails, addresses or orders, that is a personal data breach under GDPR.
The Data Protection Commission must be told within 72 hours of you becoming aware of it, unless the breach is unlikely to put anyone at risk. Where the risk to people is high, you must tell them too, without undue delay. In the UK, the same 72 hours applies, with the ICO.
The clock runs from when you find out, not from when you have finished cleaning up. If you think customer data may have been taken, keep a record of what happened and what you did, and get advice early.
What WordPress security costs
Most of this checklist is free. It costs an afternoon to set up and a few minutes a week to keep going.
What costs money is the time to keep doing it, month after month. And the cost of cleaning up when nobody did.
Our hosting and maintenance packages start at €24.99 a month, with updates and maintenance time included. The Premium package, at €59.99 a month, adds security, anti-malware protection and daily backups. Our guide to WordPress maintenance in Ireland explains what that work involves.
Questions people ask about WordPress security
Is WordPress safe to use for a business website?
Yes, if it is kept up to date and hosted properly. The vulnerabilities researchers find are overwhelmingly in plugins and themes, which is why updates and a short, trusted list of plugins do most of the work.
Is WordPress.com safe?
WordPress.com is a hosted service that runs WordPress for you and handles the core updates and server security itself. Most business sites run self-hosted WordPress from WordPress.org instead, where that job is yours or your host’s.
How often should I update WordPress?
As soon as updates are released, for security fixes. Check for plugin and theme updates at least once a week, or switch on automatic updates where it is safe to.
Can Google tell if my site has been hacked?
Often, yes. Google can flag a hacked site in its results, and Search Console’s Security Issues report tells the owner what it found. Once the site is clean, you request a review from the same report, which our guide to fixing a hacked WordPress site walks through.
Is WordPress safe for an online shop?
It can be, with the same care taken more seriously, because a shop handles customer data. We compare the options in is WordPress good for ecommerce.
If you’d rather it was simply looked after
Most business owners didn’t start a business to update plugins on a Friday evening. That is fair enough.
If you want someone else doing it, every week, with backups you know will restore and a firewall already in place, our WordPress hosting and maintenance team looks after the sites we build and the ones we inherit. And if your site has already been hacked, tell us what you are seeing, and we will tell you what it will take to put it right.
