How to Secure Your WordPress Site in 8 Simple Steps

Most WordPress hacks are not targeted — they are bots testing known weaknesses. A few habits stop nearly all of them.

Keep WordPress, themes and plugins updated, and delete anything you are not using; abandoned plugins are the usual way in. Use a strong, unique admin password with two-factor authentication, and avoid the username admin.

Add a security plugin to limit login attempts, and make sure your host runs daily backups you can actually restore.

Finally, check that your site loads over HTTPS everywhere.

None of this is glamorous, but it prevents the overwhelming majority of break-ins.