Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Protecting a WordPress login does not protect the domain that points visitors to your site. You must secure three separate control planes: WordPress administrator accounts, the registrar account that controls registration and DNS settings, and the email account used for password resets and security notices. Use unique credentials and multifactor authentication on all three, enable and understand the registrar’s transfer lock, monitor domain changes, and prepare an emergency recovery plan.
Why WordPress access and domain ownership are different
A WordPress administrator account controls the application installed on your hosting. An attacker who obtains it may publish pages, install malicious code, create new users, redirect visitors, or steal information. The registrar account controls the domain registration and commonly provides access to nameservers, DNS records, contact details, transfer settings, and renewal information. An attacker who obtains it may point your domain to another server or transfer the registration.
The email account used for registrar notices and password resets is a third control plane. If that mailbox is compromised, an attacker may reset the registrar password, approve a contact change, intercept security notices, or persuade support staff that the attacker is the registrant. Securing only WordPress therefore leaves two other routes open.
| Control plane | What it can change | What to protect |
|---|---|---|
| WordPress installation | Content, users, themes, plugins, settings and sometimes stored customer data | Every administrator and privileged account, the hosting panel, administrator devices and the installation itself |
| Registrar account | Registrant details, nameservers, DNS records, transfer status, renewal and domain contacts | Registrar credentials, MFA factors, recovery procedures, authorization codes and account permissions |
| Recovery email | Password resets, approval messages and alerts for the other accounts | A unique password, MFA, recovery methods, forwarding rules, sessions and mailbox access |
No single setting blocks every attack. A transfer lock will not stop a stolen WordPress administrator password, and a WordPress backup cannot restore ownership after a registrar transfer.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do I protect my WordPress site from hackers?
Inventory privileged access before changing settings
List every WordPress administrator, editor with unusual capabilities, hosting-panel user, deployment account and integration that can publish or modify the site. Remove dormant users, revoke old application passwords and reduce each person’s role to the minimum required. Do the same for the registrar: identify who can change DNS or transfer settings and remove shared or unused access.
Use unique passwords stored in a password manager
Give every administrator a different, long password. Never reuse the WordPress password for the registrar, email, hosting panel or another website. A password manager can generate and fill unique credentials without requiring staff to memorize them. Change a credential immediately if it was exposed, shared in a ticket, stored in an unprotected document or entered into a suspicious page.
Require multifactor authentication for every administrator
WordPress’s advanced administration guidance recommends two-factor authentication for all administrators, but WordPress core does not provide a universal built-in 2FA system. Use a maintained, compatible plugin or an identity provider, and apply the policy to administrators and other privileged users rather than only to the site owner.
Recommended Free Tools
Enroll a second authenticator where the service permits it. Store recovery codes offline or in a protected password-manager vault separate from the device they recover. WordPress.org’s own account instructions generate ten one-time backup codes and warn that losing the primary factor without a backup can permanently lock the account; that behavior is specific to that account and is not guaranteed for every WordPress plugin.
Choose the strongest factor your setup supports
| Option | Advantages | Limitations and recovery questions |
|---|---|---|
| Authenticator-app TOTP | Works on many services and can be used from multiple devices when enrolled correctly | One-time codes can be entered into a phishing site; plan for a lost or replaced phone and protect backup codes |
| Passkey or hardware security key | Designed to resist phishing; a physical key can keep the secret off the computer | Support varies by the WordPress authentication provider and registrar; enroll more than one key or another approved factor |
WordPress.org describes security keys as using biometrics, digital cryptography or hardware keys for an additional login layer. Its guidance also notes that security keys are not vulnerable to phishing attacks in the same way one-time passwords are. Check compatibility before requiring a particular factor, and keep a tested recovery route for staff who lose a device.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Keep the application and its administration path current
- Apply security updates to WordPress core, themes and plugins promptly.
- Use themes and plugins from WordPress.org or vendors with a clear maintenance and update process; remove software that is abandoned or no longer needed.
- Patch the hosting control panel, deployment tools and administrator computers and phones.
- Separate development, staging and production credentials, and remove production access from accounts that do not need it.
Limit hostile login traffic
Rate-limit login attempts at the edge or server when your hosting arrangement supports it. Blocking abusive traffic before it reaches WordPress and PHP is preferable under a heavy attack; an application-level plugin still has to execute inside PHP for each request. If only an application control is available, use it, but monitor resource use and avoid locking out legitimate administrators.
XML-RPC can be a useful dependency for some mobile apps and integrations. If your site does not need it, disable it. If a service depends on it, restrict access and rate-limit requests rather than assuming that a login-limit plugin alone will protect it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Back up for site recovery, not domain recovery
Maintain tested backups of the database, uploaded files and configuration, and document how to restore them to a clean environment. A backup can recover malicious content or a compromised installation. It does not restore a changed registrant, reverse a transfer, or return DNS control. Keep at least one backup path independent of the WordPress server so an attacker who compromises the hosting account cannot erase every copy.
How do I stop someone from stealing my domain name?
Secure the recovery email first
Use a unique long password and MFA on the mailbox that receives registrar notices and password resets. Review its recovery addresses and phone numbers, active sessions, forwarding rules, mailbox delegates, filters and app passwords. Remove an unknown forwarding rule or session immediately; an attacker can hide registrar alerts even after you change the password.
Keep the registrant email and emergency contacts accurate. CISA identifies access to a registrant’s email as one possible route to domain takeover, while ICANN guidance emphasizes current and accurate registration contacts. Email security is necessary, but it does not replace MFA and access controls on the registrar account itself.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Harden the registrar account
- Sign in from a trusted, updated device and change the registrar password to a unique value stored in your password manager.
- Enable the registrar’s strongest available MFA. Enroll a backup factor and store recovery material safely.
- Review every user, delegate, API credential and support contact with access to the account. Remove people and integrations that no longer need it.
- Confirm the registrant name, email, telephone number and emergency contact details. Record the registrar’s security or abuse contact and its emergency recovery process.
- Ask which notifications can be enabled for logins, contact changes, nameserver edits, DNS changes, lock removal and transfer requests, then send them to a monitored address.
Protect transfer authorization codes
A transfer authorization code, often called an Auth-Code, helps identify the legitimate holder and prevent an unauthorized transfer. Do not leave it in a shared inbox, public ticket, browser note or team document. Provide it only through the registrar’s authenticated transfer process and treat a request for the code as sensitive even when it appears to come from support.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsEnable a transfer lock and ask about registry lock
Most registrars offer a domain transfer lock, also described as a registrar lock or a transfer-prohibited status. It can block certain transfers or changes until an authorized person removes it. The label, exact scope and removal process vary. Some registrars require MFA to remove a lock; others require a registrant authorization step.
For a high-value or business-critical domain, ask whether the applicable registry offers a registry lock. Registry lock may add stronger, registry-level checks, but availability, pricing, supported extensions and emergency-change procedures differ. Neither kind of lock is a universal guarantee: an attacker who takes over the registrar account may attempt to remove a registrar lock, and a lock does not prevent every DNS or account attack.
How do I lock my domain so it cannot be transferred?
You cannot make a domain absolutely impossible to transfer. You can add layers that make an unauthorized transfer harder and create an opportunity to detect it.
| Protection | What to ask the provider | Important limitation |
|---|---|---|
| Registrar transfer lock | Which transfers or changes does it block? How is it removed? Is MFA or registrant approval required? How are emergency changes handled? | Implementation and status names vary, and an account takeover may allow the attacker to request removal. |
| Registry lock | Is it available for this top-level domain? What identity checks, fees and response times apply? | Not universally available; it can complicate legitimate urgent changes and still requires a reliable recovery process. |
| Transfer authorization code | How is the code issued, rotated and protected? Who may request it? | Exposure of the code can help an attacker attempt a transfer, so it must not be shared casually. |
After enabling a lock, verify the status in the registrar dashboard and save the confirmation. Recheck it after account changes, renewal work or support interactions. Ask the registrar how it will authenticate you if a legitimate transfer or DNS emergency requires an unlock.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Monitor the domain instead of relying on a lock
Turn on every relevant alert your registrar provides. Useful categories include new logins, password or MFA changes, registrant-contact edits, nameserver and DNS changes, lock changes, transfer requests, completed transfers and renewal or payment events. These features differ by provider, so confirm what is actually enabled rather than assuming that all alerts exist.
At a regular interval, review:
- Registrant name, email address and emergency contacts.
- Domain status, transfer-prohibited state and expiration date.
- Nameservers and important DNS records, including mail and verification records.
- Registrar users, delegates, API tokens and recent account activity.
- WordPress administrators, privileged roles, active sessions and installed extensions.
- Whether renewal notices reach a monitored mailbox and whether payment details are current.
Keep a dated record of the expected nameservers, DNS records, registrant details and registrar account owner. That baseline makes an unauthorized change easier to recognize and gives support evidence of the previous state.
What should I do if my domain was hijacked?
Treat an unexpected registrant change, nameserver change, DNS edit, transfer notice or registrar login as an incident. Speed matters because an attacker can use the domain to impersonate your business, intercept mail or distribute malware.
- Contact the registrar immediately. Use its abuse, security or emergency-support route, not a random phone number from an unsolicited message. State which changes were unauthorized, when you noticed them and that you are requesting account security and restoration.
- Secure the recovery email and related accounts. From a clean, trusted device, change the email password, revoke unknown sessions and app passwords, remove forwarding rules, enable MFA and then change the registrar and hosting credentials.
- Ask the registrar to contain the account. Request that it preserve relevant logs and notices, review unauthorized users and API access, and explain its account-recovery and restoration process. Do not assume that changing one password removes an attacker’s sessions or delegates.
- Preserve evidence. Save alert emails with their headers where possible, timestamps, support-ticket numbers, domain-status screens, previous invoices or registration records, DNS snapshots and communications with support. Do not delete evidence while attempting cleanup.
- Separate domain recovery from WordPress cleanup. Check the hosting account, WordPress users, plugins, files and DNS-dependent services independently. Restore the site from a known-clean backup only after credentials and access paths are controlled.
- Escalate a transfer dispute. If the domain moved to another registrar or the registrant was changed, ask your registrar about its urgent transfer-dispute and restoration procedures. For gTLD matters, an ICANN complaint process may be relevant, but ICANN states that it does not have contractual authority to require a registrar to transfer a domain back to a different registrar or registrant.
Do not promise customers a particular restoration time or outcome. Country-code domains and some specialized services follow different policies, so the applicable registry and registrar rules determine the available remedy.
Build a recovery plan before an incident
Document ownership and contacts
Store the domain name, registrar, registrant information, account owner, emergency contacts, renewal date, hosting provider and DNS dependencies in a protected internal record. Include the registrar’s official emergency route and the people authorized to approve a change. Keep a second authorized person able to act if the primary administrator is unavailable.
Test access without weakening security
Verify that an authorized administrator can sign in with MFA, retrieve a backup factor, view the transfer-lock status and reach emergency support. Test WordPress restoration separately. Do not test by disabling locks or MFA on a production account; use the provider’s documented recovery procedure and record the result.
Plan for lost devices and staff departures
When an administrator leaves, remove WordPress, registrar, email, hosting and password-manager access in one coordinated checklist. Rotate shared secrets and API credentials, review forwarding rules and confirm that backup authenticators belong to current staff. For a lost device, revoke its sessions and factor before issuing a replacement.
Quick Recap
Common protection mistakes
- Securing WordPress but not the registrar: application security cannot stop a nameserver change.
- Using one mailbox for everything without hardening it: the mailbox becomes a master reset path.
- Assuming a transfer lock is permanent: learn who can remove it and what verification is required.
- Leaving Auth-Codes in shared systems: restrict access and rotate or invalidate a code when exposure is suspected.
- Relying on a login plugin during a traffic flood: use edge or server controls when the hosting setup allows them.
- Keeping backups on the same compromised account: maintain an independent copy and practice restoration.
- Ignoring DNS monitoring: a site can appear intact in WordPress while its domain points somewhere else.
- Letting contact details become stale: inaccurate registration information can delay legitimate recovery and support verification.
A practical protection sequence
- Secure the recovery email with a unique password, MFA, current recovery details and no unauthorized forwarding or sessions.
- Remove unnecessary WordPress and registrar users, then assign least-privilege roles.
- Set unique passwords and MFA for WordPress, the registrar, hosting and email; enroll backup factors.
- Enable the registrar transfer lock, ask about registry lock, and document unlock requirements.
- Protect Auth-Codes and restrict who may request or use them.
- Enable available alerts for account, contact, DNS, nameserver, lock and transfer changes.
- Patch WordPress, extensions, hosting tools and administrator devices; limit login traffic and unused XML-RPC.
- Maintain independent, tested WordPress backups and a written registrar emergency plan.
- Review the domain, DNS, users and alerts on a schedule and after every staffing or provider change.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
