Prevention

What preventing WordPress hacks looks like in practice

The common ways in are ordinary: an outdated plugin, a password reused somewhere else, an admin account nobody remembers creating, a theme downloaded from a free-download site.

Preventing WordPress hacks does not need enterprise tooling. It needs updates that actually happen, accounts that are removed when people leave, backups you have tested, and some way of noticing a change quickly. The answers here cover each of those.

There is a difference between security theatre and prevention that works. Hiding the login page stops very little on its own. Removing a plugin you no longer use removes a whole class of problem permanently. When you are deciding what to spend an afternoon on, prefer the changes that delete risk over the ones that only obscure it: fewer plugins, fewer accounts, fewer places where old code can sit unnoticed for a year.

Get a free security check