iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Protect a WordPress site by combining timely updates, careful access control, layered defenses, and backups that include both files and the database. If you suspect a compromise, preserve what you observe, contact your host, secure credentials, and clean the site methodically rather than relying on a single scanner or deleting files at random.
Build protection in layers
WordPress’s core security guidance calls keeping WordPress, plugins, and themes up to date the most important security step. Choose extensions from trusted sources, favor software that is actively maintained, and remove plugins and themes you no longer use. Older WordPress releases are not maintained with security updates; the latest major release is the only officially supported version, and updates for older branches have no guaranteed schedule. WordPress hardening guidance and the supported versions policy explain the current approach.
Use automatic updates carefully
WordPress has supported automatic core updates since version 3.7; plugin and theme auto-updates arrived in WordPress 5.5. Before enabling automatic updates for extensions, ensure you can roll back or restore the site if an update causes a problem. Scheduled updates depend on WordPress Cron, and a host or plugin may disable the controls. If updates appear stuck, check Dashboard → Tools → Site Health. See WordPress’s plugin and theme auto-update documentation.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Limit access and protect credentials
- Give administrator access only to people who need it, and use long, unique passwords and multifactor authentication where available.
- Keep track of every route into the site: WordPress accounts, hosting control panel, FTP or SFTP, and database credentials.
- Review extensions that request write access, and avoid arbitrary code execution plugins unless there is a clear, controlled need.
Choose security layers that fit the site
Filtering can happen in a WordPress plugin, at the web server (for example, with a server-level WAF such as ModSecurity), or in a reverse proxy before traffic reaches the host. These are different layers, not interchangeable guarantees. Assess who maintains the rules, what activity is logged, whether monitoring or human cleanup is included, and how the setup affects your server and site features. Restricting access to /wp-admin/, for example, can interfere with features such as admin-ajax.php; test compatibility before making configuration changes. WordPress discusses these options in its hardening guidance.
Keep logs accessible. They can help establish which IP addresses were involved, when activity occurred, and what actions took place if you need to investigate a suspected incident.
Make backups you can actually restore
A recoverable WordPress backup generally needs both the site’s files and its database. A copy of the web directory alone usually does not include the separate database. Keep the two parts together as a coordinated backup set, and periodically verify that automated backups complete and can be restored.
Set a backup schedule and retention
WordPress’s handbook suggests weekly backups for smaller sites and daily backups for high-activity sites. These are general suggestions, not a universal schedule: choose a frequency based on how much recent content or transaction data you can afford to lose. The same handbook recommends keeping three to five recent copies in different locations. For example, retain one with the host, another in separate cloud storage, and another on a local computer. A physical external drive can be an additional local copy, but by itself it is only one location—not a complete backup plan or malware defense. Read WordPress’s backup guidance.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteProtect and test backup copies
- Use encryption and read-only or otherwise protected storage where feasible to reduce the risk of unauthorized changes to backup copies.
- Make a manual backup periodically to confirm the automated process is working.
- Before updating software, check that rollback or restore is available.
- Test restoration and consider whether restoring an older copy could reintroduce a compromise.
What to do if your WordPress site may be compromised
Unauthorized accounts or site changes, browser or antivirus warnings, search blacklisting, malware-distribution flags, and a host suspension can indicate a compromise. An outage can have other causes, so check with the hosting provider rather than treating every disruption as proof of malware.
- Record what happened. Note symptoms, when they began (including the timezone), recent changes, and relevant hosting details. Preserve observations and evidence before changing the environment where practical. WordPress’s hacked-site guidance identifies documentation as the first actionable post-compromise step: FAQ: My site was hacked.
- Contact your host. This is especially important on shared hosting, where other sites or the server may be involved. Ask about server-side findings and available backup or restore options.
- Scan the site and the administrator’s computer separately. Application-level scanners and remote crawlers examine a site from different vantage points. Also scan the computer used to administer it: a compromised machine can expose FTP or administrator credentials. A clean scan of that computer does not prove the server is clean.
- Secure access and preserve a snapshot. Reset passwords for administrators and other relevant accounts, rotate credentials for WordPress, hosting, FTP or SFTP, and database access, and change WordPress secret keys to sign out active sessions. Capture a snapshot before cleanup for reference and investigation.
- Clean based on evidence and capability. Replacing WordPress core directories is not the same as reviewing
wp-content, which contains themes and plugins. Avoid blind deletion: it can lose data while leaving persistence mechanisms behind. If the scope is unclear or the site handles important customer data, involve a qualified incident-response provider. - Re-harden and investigate the entry point. After cleanup, update WordPress and extensions, change passwords again, and review logs and host findings to determine how access was gained. Confirm that the site is no longer flagged.
The exact cleanup depends on the symptoms and the owner’s technical ability; these steps are a practical outline, not a universal forensic procedure. For ransomware, the official WordPress sources cited here do not provide a detailed playbook for ransom negotiations, decryption, legal or reporting duties, or data-breach notification. If business-critical systems or sensitive data may be affected, work with your host and a qualified incident-response professional.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to assess a security or backup service
Compare services on what they actually do and what you can verify, not on a broad promise to “secure” a site.
Quick Recap
- Security layer: Where does filtering happen—inside WordPress, at the server, or in a reverse proxy? Who maintains the rules, and what compatibility or operational changes are required?
- Monitoring and evidence: Is activity monitored? Are logs retained, and can you access them? Is human cleanup included, and what incident scope does it cover?
- Backup coverage: Are both files and database included? How often are copies created, how long are they retained, and are they separated from production storage?
- Recovery: Are backups encrypted and access-controlled? How is a restore tested, how quickly can it be completed, and how will you avoid restoring a compromised copy?
- Cleanup support: Does the service address evidence preservation, credential rotation, persistence checks, restore strategy, and post-cleanup hardening?
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
