WordPress powers a huge chunk of the web. That also makes it a huge target. I've seen countless support tickets where a simple fix was all that stood between a site and a compromise. Many of those issues come down to the same few mistakes. Here are nine common WordPress security mistakes and exactly how to fix them.
1. Using “admin” as the Username
This one is vintage. The default WordPress installation used to set the admin username to “admin”. Attackers love this — they already know half of the login credentials. Brute-force scripts always try admin:password first.
The fix: Create a new user with a unique username, give it Administrator role, then delete the old “admin” user. Assign all posts to the new user.
-- Not directly doable in SQL safely, so use the WordPress dashboard:
-- Users > Add New, then Users > Delete the admin account.
If you already have an “admin” user, don't just rename it via the database — that can break things. Better to create a fresh one.
2. Weak Passwords
Still seeing password123. Or worse, 123456. A strong password is your first line of defense. Use a password manager. Generate 20-character random strings.
The fix: Enforce strong passwords for all users. Install a plugin like "Force Strong Passwords" or use cPanel's password strength settings. For existing users, force a password reset.
# On a server with WP-CLI, you can update a user password:
wp user update <user_id> --user_pass="$(openssl rand -base64 20)"
3. Ignoring Updates
Outdated core, themes, or plugins are the number one entry point for attackers. I've patched sites that were years behind. Not updating is like leaving your front door unlocked.
The fix: Enable automatic updates for minor core releases. For major versions, test on a staging site first. Keep a strict update schedule — weekly is good.
// In wp-config.php, you can force automatic updates:
define( 'WP_AUTO_UPDATE_CORE', true );
Use a plugin like "Easy Updates Manager" if you want fine-grained control.
4. No SSL/TLS Certificate
Sites without HTTPS submit login credentials in plain text. You wouldn't shout your password across a coffee shop. Don't do it over the internet.
The fix: Get a free SSL certificate from Let's Encrypt via your hosting control panel. Then force all traffic to HTTPS.
# In .htaccess, redirect HTTP to HTTPS:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]
5. Leaving Unused Themes and Plugins Installed
Old, unmaintained code is a liability. An inactive plugin can still contain vulnerabilities that get exploited.
The fix: Delete any theme or plugin you're not actively using. Not just deactivate — delete. If you need it later, reinstall.
6. No Login Attempt Limiting
Without rate limiting, an attacker can try thousands of passwords per minute. Default WordPress gives unlimited attempts.
The fix: Use a plugin like "Limit Login Attempts Reloaded" or add code to your theme's functions.php. Better yet, use a web application firewall (WAF) at the server level.
// Simple rate-limiting snippet (use cautiously):
add_filter( 'authenticate', 'limit_login_attempts', 30, 3 );
function limit_login_attempts( $user, $username, $password ) {
// Implementation omitted for brevity; use a tested plugin.
}
7. Incorrect File Permissions
Setting files to 777 or directories to 777 is an open invitation. Attackers can upload malicious scripts or modify your files.
The fix: Use secure permissions: - Directories: 755 - Files: 644 - wp-config.php: 600 (if possible)
# From the WordPress root directory:
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 600 wp-config.php
8. Overreliance on a Single Security Plugin
A security plugin is not a silver bullet. I've seen sites with Wordfence installed but everything else wide open. They had the plugin, but the real problems ran deeper.
The fix: Defense in depth. Use a security plugin for monitoring and firewall, but also apply all the other measures here. Harden your server, keep things updated, and monitor logs.
9. Skipping Regular Backups
No backup means no recovery. Ransomware, a catastrophic update, or a simple mistake can wipe you out. Without a recent backup, you're starting from scratch.
The fix: Automate daily backups to an off-site location (cloud storage, remote server). Test restores at least monthly. Use a plugin like UpdraftPlus or your host's backup solution.
# Example cron job for backups via WP-CLI:
0 3 * * * /usr/local/bin/wp db export /backups/site-$(date +\%Y\%m\%d).sql --path=/var/www/html
Frequently Asked Questions
Q: Do I need all of these measures? A: Yes, every layer counts. Attackers look for the weakest link. One missing fix could be enough.
Q: What if I'm on shared hosting? Can I still secure my site? A: Absolutely. Most of these fixes are within your control. For server-level settings, contact your host.
Q: Should I use a WAF? A: A web application firewall (like Cloudflare or Sucuri) adds a strong outer layer. Highly recommended.
What to check first
Security isn't a one-time task. It's ongoing. Start with the low-hanging fruit: change the admin username, set strong passwords, update everything, install SSL. Then layer on the rest.
Log in to your server, run through each mistake, apply the fixes. Do it today. Tomorrow might be too late.