You installed WordPress. It runs. Now you need to stop attackers from hijacking it before they do.
WordPress security sounds complicated, but the first pass is straightforward: limit who can do what, keep software current, block obvious exploits, and have a recovery plan. This guide assumes you know nothing about security jargon and walks you through each piece in the order that makes sense for a brand-new site.
Why fresh WordPress installs attract attacks
Bots scan the internet for WordPress sites constantly. They try default admin usernames, probe for outdated plugins, and look for open upload directories. A fresh install with the default "admin" account and no firewall is visible within hours.
WordPress itself gets patched regularly, but the risk comes from three places: weak passwords, outdated plugins or themes, and misconfigurations that let an attacker upload a shell script. Most compromises I've seen in support tickets trace back to one of those.
Step 1: Delete the admin user and pick a strong password
During the five-minute install, WordPress asks for a username. Many people type "admin" out of habit. Bots know this. They hammer /wp-login.php with common passwords against "admin" until something works or the server blocks them.
Log in to your WordPress dashboard. Go to Users → All Users. If your account is named "admin", create a new administrator account with a unique username (not "administrator", "root", or your domain name). Use a password manager to generate a random 16-character password with mixed case, numbers, and symbols. Log out, log back in as the new user, then delete the old "admin" account. WordPress will ask you to reassign posts; pick the new account.
A user role in WordPress controls what someone can do. Administrator can install plugins and change any setting. Editor can publish and manage posts. Author can publish their own posts. Contributor can write but not publish. Subscriber can only comment. Never give someone Administrator unless they're managing the site.
Step 2: Install a security plugin
A plugin is a piece of software that extends what WordPress can do. Security plugins watch login attempts, scan files for changes, block malicious requests, and enforce rules like two-factor authentication.
Two popular free options are Wordfence and Sucuri Security. Both work well for a beginner. I'll use Wordfence as the example because it bundles a firewall, malware scanner, and login protection in one package.
From your dashboard, go to Plugins → Add New Plugin. Search for "Wordfence Security". Click Install Now, then Activate. The plugin adds a new menu item on the left.
Open Wordfence → All Options. Enable these settings:
- Immediately block the IP of users who try to sign in as these usernames: add "admin", "administrator", "test", "root". This stops bots cold.
- Enable two-factor authentication: forces you to enter a time-based code from your phone after the password. It's a pain, but it means a stolen password alone can't get in.
- Lock out after how many login failures: set to 5 attempts. Bots try hundreds; real users rarely fail five times.
- Amount of time a user is locked out: 15 minutes is fine.
Wordfence will also run a scan and compare your files against the official WordPress repository. If it finds a backdoor someone else planted, you'll see it. On a fresh install, you should see green checks.
What if I already have a security plugin?
Stick with one. Running Wordfence and Sucuri together causes conflicts—both try to modify the same login flow. Pick whichever interface makes more sense to you and remove the other.
Step 3: Update everything right now
An update is a new version of WordPress core, a plugin, or a theme that patches bugs or security holes. Attackers search for sites running old versions with known exploits.
Go to Dashboard → Updates. You'll see three sections: WordPress core, plugins, and themes. Check every box and click Update. This takes a minute or two. Your site might show a maintenance message while it runs.
Turn on automatic updates for minor releases. Go to the same Updates page and look for "This site is automatically kept up to date with each new version of WordPress." If that's not there, automatic updates are off. You can enable them by adding this line to wp-config.php (the configuration file in your WordPress root directory):
define( 'WP_AUTO_UPDATE_CORE', true );
Some hosts enable this by default. Check with them if you're unsure how to edit wp-config.php.
Plugins and themes don't auto-update unless you explicitly enable it. For each plugin, go to Plugins → Installed Plugins, hover over the plugin name, and click Enable auto-updates. Do the same for themes under Appearance → Themes. This keeps you patched without manual checks, but test on a staging site first if you run a complex setup.
Step 4: Change the database table prefix
WordPress stores posts, users, and settings in a database—a structured file that MySQL or MariaDB manages. By default, every table name starts with wp_: wp_users, wp_posts, and so on. SQL injection attacks often assume this prefix. Changing it adds a small hurdle.
If you just installed WordPress, you can set a custom prefix during setup by editing wp-config.php before the installation script runs. Look for this line:
$table_prefix = 'wp_';
Change wp_ to something random like x7j_ or mn4_. Use letters, numbers, and underscores only, and always end with an underscore.
If your site is already running, changing the prefix requires renaming tables in the database and updating references in the options table. Plugins like iThemes Security can do this, but back up first (we'll cover backups next). For a brand-new site with no content, it's easier to reinstall WordPress with a custom prefix from the start.
Step 5: Set up backups
A backup is a snapshot of your files and database at a point in time. If your site gets hacked, crashes, or you break something during an update, you restore the backup and you're back.
WordPress itself doesn't back up automatically. Your hosting provider might; check their control panel. cPanel usually has a Backup Wizard. Managed WordPress hosts like Kinsta or WP Engine include daily backups. Confirm this before assuming it exists.
If your host doesn't back up or only keeps backups for a few days, install a backup plugin. UpdraftPlus is free and sends backups to Google Drive, Dropbox, or an S3 bucket. BlogVault and Jetpack Backup are paid options with more hand-holding.
After installing UpdraftPlus, go to Settings → UpdraftPlus Backups. Click Settings, choose a remote storage location (not the same server—if the server dies, local backups die too), and set a schedule. Daily backups with a two-week retention window work for most small sites. Click Save Changes, then go back and click Backup Now to test it.
Download one backup and open the files. You should see a SQL dump of your database and a zip of your themes, plugins, and uploads. If the backup is empty or fails, check the UpdraftPlus logs under Expert Settings or contact support.
Step 6: Lock down file permissions
File permissions are Unix rules that control who can read, write, or execute a file. WordPress needs to write to wp-content/uploads when you add media, but it should never write to wp-config.php or core files after installation. Tight permissions stop an attacker from modifying PHP files if they find an upload bug.
Connect to your server via SFTP (secure file transfer protocol) using FileZilla or the file manager in cPanel. Navigate to your WordPress root directory (often public_html or www).
Set these permissions (in octal notation, which is what cPanel and SFTP clients use):
- All directories:
755 - All files:
644 wp-config.php:440or400if your host allows it
In cPanel File Manager, right-click a file or folder, choose Change Permissions, and enter the number. In FileZilla, right-click and choose File permissions.
If WordPress complains it can't write during an update, you may need to temporarily loosen permissions on wp-content, run the update, then tighten them again. Some hosts require 775 on directories if PHP runs as a different user. Check with your host if you see errors.
What do those numbers mean?
Each digit represents a user class: owner, group, others. The digits are sums of read (4), write (2), and execute (1). So 755 means owner can read/write/execute (7), group can read/execute (5), others can read/execute (5). 644 means owner can read/write (6), group and others can only read (4). You don't need to memorize this; just apply the numbers above.
Step 7: Hide the WordPress version and disable file editing
By default, WordPress advertises its version number in the HTML source and RSS feeds. Attackers script searches for old versions. Hiding it doesn't stop a determined attacker, but it filters out lazy bots.
Add this to your theme's functions.php file (under Appearance → Theme File Editor, though we'll disable that editor in a moment):
remove_action( 'wp_head', 'wp_generator' );
This removes the <meta name="generator"> tag.
WordPress also includes a built-in code editor under Appearance → Theme File Editor and Plugins → Plugin File Editor. This is convenient but dangerous—one typo in a PHP file can break your site, and if an attacker gets admin access, they can inject code directly. Disable it by adding this line to wp-config.php:
define( 'DISALLOW_FILE_EDIT', true );
Put it anywhere above the line that says /* That's all, stop editing! */. Save the file. The editor menu items disappear.
What about SSL and HTTPS?
An SSL certificate encrypts traffic between your visitor's browser and your server. Without it, passwords and session cookies travel in plain text. Most hosts offer free Let's Encrypt certificates through cPanel or their control panel.
In cPanel, look for SSL/TLS Status or Let's Encrypt. Select your domain and click Issue. The certificate installs in seconds. Then go to WordPress Settings → General and change both the WordPress Address (URL) and Site Address (URL) from http:// to https://. Save changes.
Install the Really Simple SSL plugin if you see mixed-content warnings (some images or scripts still load over HTTP). The plugin rewrites internal links automatically. After a day or two, you can usually deactivate it; the job is done.
What to check every month
Security isn't one-and-done. Set a calendar reminder to:
- Review login attempts in Wordfence or your security plugin. Look for patterns (same IP trying multiple usernames).
- Check for plugin and theme updates. If you enabled auto-updates, confirm they're running.
- Download a fresh backup and spot-check it.
- Scan for malware using Wordfence or Sucuri.
- Review user accounts and delete any you don't recognize.
Most hacks go unnoticed for weeks because no one checks. A monthly five-minute review catches problems early.
How do I know if I'm already hacked?
Common signs: unexpected admin accounts, posts you didn't write, site redirects to spam, or a sudden traffic spike from bots. Run a malware scan immediately. If it finds infected files, restore from a clean backup, change all passwords, and figure out how they got in (usually an outdated plugin).
Do I need a firewall?
Wordfence includes an application-level firewall that blocks bad requests before they reach WordPress. A web application firewall (WAF) like Cloudflare or Sucuri's paid plan sits in front of your server and blocks attacks before they hit your hosting account. For a small site, Wordfence is enough. High-traffic or high-value sites benefit from Cloudflare's free plan at minimum.
Should I change the login URL?
Plugins like WPS Hide Login change /wp-login.php to something custom. This stops most bot traffic, but it's security through obscurity—once someone finds your real URL, it offers no protection. I'd prioritize strong passwords and two-factor authentication first. Changing the login URL is a nice bonus, not a substitute.
What if I can't access the dashboard after enabling two-factor?
Most security plugins offer a recovery method. Wordfence lets you disable two-factor by renaming the plugin folder via SFTP (change /wp-content/plugins/wordfence to /wp-content/plugins/wordfence-disabled). Log in, turn off two-factor, then rename the folder back and reactivate the plugin. Check the plugin's documentation for the exact steps.
What to check first after setup
You've now locked the front door: strong password, active firewall, automatic updates, offsite backups, tight file permissions. Test that you can log in, that backups restore, and that updates don't break your site.
The next layer—hardening the server, adding CSP headers, restricting database users—matters once you're live and handling real traffic. For a new site, the seven steps above stop 95% of automated attacks. Build from there as you learn.