Seven ways to keep your WordPress site secure

Nobody is targeting your site personally. Bots scan millions of sites a day, looking for the easiest way in. Your goal is not to be impossible to hack, just harder than the next site on the list.

1. Keep everything updated

Outdated plugins are the most common way in. Update WordPress core, plugins and themes regularly, and delete plugins and themes you no longer use, because inactive code can still be exploited.

2. Use strong, unique passwords and two-factor sign-in

Every administrator should have a long, unique password from a password manager, and two-factor sign-in where possible. Remove old accounts for people who no longer work on the site.

3. Give people only the access they need

An editor does not need to be an administrator. In your hosting panel too, give contractors access to the one site they work on, not your whole account.

4. Block repeated login attempts

Brute-force bots try thousands of passwords. Blocking an address after a handful of failed logins stops them cold. On Netkeel this runs on every server: repeated failed logins and request floods are banned automatically.

5. Keep sites apart

If several sites share one server, each should run as its own system user, so a problem on one site cannot spread to the others. Netkeel isolates every site this way.

6. Use HTTPS everywhere

An SSL certificate encrypts logins and form data. Certificates are free from Let's Encrypt, so there is no reason for any page to be served without one.

7. Have a backup you have actually tested

Security is also about recovery. Make sure backups run automatically, that at least one copy lives somewhere other than the server, and that you have tried a restore at least once. Our guide to backups explains how.