Most WordPress sites are compromised through an old plugin or a weak password rather than through anything sophisticated. The basics below cover the overwhelming majority of real attacks.
#The order that matters
Keep everything updated
WordPress, the theme, the Pro plugin and every third party plugin. An abandoned plugin with a published vulnerability is the most common way in that exists.
Delete what you do not use
An inactive plugin is still code on your server. A deactivated plugin with a vulnerability can still be reachable. Delete rather than deactivate.
Use unique passwords and two factor authentication
A unique password per site, and two factor on any account that can install code. That is administrators, not everyone.
Set up automatic backups
Automatic, stored somewhere other than the same server, and tested by actually restoring one occasionally. An untested backup is a belief rather than a backup.
#The rest, in one paragraph each
HTTPS on every page, with the site addresses in SettingsGeneral both using it.
Minimum permissions. Give people the role they need. An editor does not need to install plugins, and most sites have exactly one account that should be an administrator.
Decent hosting. A host that patches its own stack, isolates accounts and keeps logs does more for you than any plugin. Logs in particular: without them, you cannot tell what happened.
Four basics beat a stack of security plugins running at once.
HTTPS, least privilege, a secure host and logging matter more than any of them, and several security plugins together conflict, slow the site down and produce so many notifications that you stop reading them.
#Nulled and unofficial copies
A theme or plugin from a mirror site is the most reliable way to get a backdoor installed deliberately.
That is not a warning about licensing, it is the actual mechanism by which those files are distributed for free, and it is why nulled copies show up in security incidents far more often than in licensing disputes.
#If you think the site is compromised
Signs worth taking seriously: unfamiliar administrator accounts, content you did not write, redirects to another site, a warning from your host or from a browser, files with recent modification dates you cannot explain.
The first safe steps:
Take a full backup as it is now, even though it is infected, so you can investigate later
Change every administrator password
Change your hosting and database passwords
Update everything
Restore from a known clean backup if you have one
Cleaning a compromised site properly is specialist work. Restoring a clean backup and then closing the way in is faster and more reliable than hunting for injected code by hand.
#Common questions
Do I need a security plugin?
One, if you want the monitoring and login hardening it provides, and not three, and in either case it supplements the basics rather than replacing them.
Is WordPress insecure?
WordPress core is maintained and patched quickly, and the risk lives in what people add to it and in how long they leave it unpatched.
Should I hide the WordPress version?
It changes nothing an attacker cannot determine another way, so the same half hour is better spent on updates.
My host says the site is clean, and it still redirects
Check for injected code in the database as well as in the files, and clear every cache, because a cached copy of an infected page outlives the infection that produced it.
I cannot get back in at all
Your host can reset access at the database level and that is faster than anything you can do from outside, so contact them before trying recovery steps that may overwrite the evidence of how it happened.
#Still stuck
Open a support ticket if the theme itself is involved. For a compromised site, your host is the faster first call.
Last updated
