Published: 02.09.2026
WordPress is safe when it is looked after, and it is the most targeted platform simply because it is the most popular. Most successful attacks use mistakes that are easy to avoid. Here are ten of the most common and how to fix them.
1. Leaving the core, themes and plugins outdated
Attackers scan the internet for sites that run versions with known holes. Turn on automatic updates for security releases and check for other updates weekly. Test major updates on a copy if the site is critical.
2. Using nulled themes and plugins
Pirated copies of paid products often contain hidden backdoors. The savings are never worth the risk. Download extensions from the official directory or from the developer.
3. Keeping unused plugins and themes
Deactivated code still lives on the server and can be attacked. Delete everything you do not use. Keep only one default theme as a fallback.
4. Weak administrator passwords and the user name "admin"
Bots try thousands of common passwords against the login page. Use long unique passwords, create a personal administrator account with a different name and delete the default one.
5. No two-factor authentication
A second step at login stops almost all password-guessing attacks and stolen credentials. Enable it for every administrator and editor.
6. Giving everyone the administrator role
An editor or an author does not need to install plugins. Assign the lowest role that allows a person to do the job, and review accounts every few months.
7. No limit on login attempts
Without limits a bot can try passwords all day. Use a plugin or a server tool that blocks addresses after several failed attempts, and consider moving the login page behind an extra layer of protection.
8. Wrong file permissions and the built-in file editor
Files that are writable by everyone let attackers change them. Use safe permissions, and disable the theme and plugin editor in the dashboard with a constant in the configuration file.
9. No backups, or backups in the same place
If the backup sits in the hacked account, it can be deleted or infected as well. Store automatic backups in another location and test a restore at least once.
10. Ignoring the signs of an attack
Many owners learn about a hack from their customers. Use monitoring that alerts you to file changes, new users and sudden traffic changes, and check the search console for security issues.
Bonus: leaving XML-RPC and the REST user list open
XML-RPC allows many login attempts in one request, and the user list can reveal account names. Disable what you do not use and hide the list of authors if you do not need it.
A short hardening routine
- Updates every week.
- One security plugin or a server firewall, not five.
- SSL everywhere and HSTS.
- Daily backups to a different place.
- Monthly review of users, plugins and logs.
If the site is already hacked
Do not simply delete a strange file and hope. Restore from a clean backup, update everything, change all passwords including database and hosting, regenerate the security keys and remove the vulnerable component. Then check the site with a malware scanner.
Frequently asked questions
Is WordPress insecure by design? No. Most problems come from outdated or untrusted extensions and weak access control.
Do I need a paid security plugin? Free tools are enough for many sites; what matters is that the basics are configured.
Can my hosting provider protect me? Good hosting adds a firewall, isolation and backups, but you still need to update and use strong passwords.
