Most hacked WordPress sites aren't targeted — they're unlocked. Automated bots sweep the internet for stale plugins, weak passwords, and forgotten admin accounts, and they don't care whether you're a Fortune 500 or a four-page bakery site. The good news: five unglamorous habits stop the overwhelming majority of it.
The five habits that do the heavy lifting
- Update on a schedule, not on a whim. Stale software is how sites actually get breached. Pick a weekly slot, update everything, glance at the site after. (Better: do it on staging first.)
- Kill shared and stale accounts. Every human gets their own login; every departed contractor loses theirs the day they leave. No account named "admin."
- Passwords come from a manager, not a memory. Long, random, unique. Add two-factor for anyone with administrator rights.
- Backups that live somewhere else. Daily, automatic, stored off the server, and — this is the part everyone skips — test a restore once. A backup you've never restored is a rumor, not a backup.
- Watch the door. Know when someone logs in, from where, and what changed. Failed-login floods and surprise new admin accounts are how break-ins announce themselves before they hurt.
What about security plugins and firewalls?
Useful, in their place. A firewall filters known-bad traffic; login limits blunt brute force. But a security plugin bolted onto a site with stale software and shared passwords is a deadbolt on a tent. Do the five habits first; add the firewall as the second layer, not the substitute.
How do I know if I've already been compromised?
Warning signs worth acting on: admin users you don't recognize, plugins you didn't install, traffic your analytics can't explain, spam pages in Google results for your own domain, or your host emailing about malware. This is where an activity log with security analytics earns its place — it turns "something feels off" into "a new admin account was created Tuesday at 3am from an IP in a country we've never logged in from."
Frequently asked questions
Is WordPress itself insecure?
Core WordPress is well-maintained and patched fast. Almost all real-world compromises come through outdated plugins and themes, weak credentials, or bad hosting — the ecosystem around WordPress, not WordPress itself.
Do I need all this for a small brochure site?
The bots scanning for stale plugins don't check your traffic numbers first. The five habits cost maybe twenty minutes a month — cheap insurance against a rebuilt-from-scratch weekend.
What's the single highest-impact change?
If you only do one thing today: turn on two-factor authentication for every administrator account. It converts "guessed password" from a site takeover into a dead end.