How do I stop my WordPress site getting hacked again?

If something's already wrong

Hacked, flagged, redirecting somewhere strange, or throwing errors? I find the real cause — not just the symptom — clean it out completely, and close the door it came through. I've done this on more than 10,000 sites.

The pattern is consistent: most infections don't happen through some sophisticated exploit. They happen through an outdated plugin, a weak or reused password, or a vulnerability that was patched months ago but never applied. Finding that specific entry point is what separates a clean-up that lasts from one that doesn't.

So it never happens again

Hardening, firewalls, backups, monitoring, and quiet monthly maintenance. Your site stays fast, safe and online while you get on with your business. You'll only hear from me with good news.

Hardening isn't a single action, it's a set of them working together — tightening file permissions, removing anything unused that could be an entry point, and putting a firewall in front of the site so most attempts never reach it in the first place. None of it is dramatic. It's the kind of unglamorous work that means nothing happens.

Care plans

This is ongoing care, not one-off panic. Monthly monitoring and maintenance for peace of mind — because the sites that never get hacked twice are the ones someone is actually watching.

What this means for you

If your site has been hacked once, treat it as a signal, not a one-off. Whatever let the attacker in the first time is worth finding and closing properly — otherwise the same door tends to get used again.

What a proper monthly maintenance check actually includes

"Monthly maintenance" sounds vague until you break it down. It's not one task. It's a short list, done the same way, every month, without skipping steps.

Updates come first. Plugins, themes, and WordPress core all get checked and applied. Not blindly — each update gets tested first, because a bad update can break a site almost as fast as a hack can.

Log review comes next. Server logs and login logs get scanned for anything odd. A spike in failed logins, or one IP hitting the same file over and over, is the kind of thing a scan alone won't flag.

Backup verification matters more than people think. A backup that's never been tested by actually restoring it isn't really a backup. It's a hope. Part of what it takes to stop WordPress hacks for good is knowing your backup actually works before you need it.

Credential audits round it out. Old user accounts get removed. Weak passwords get flagged. Anyone who left the team but still has access gets cut off. This is the step most owners forget entirely.

Building a security habit, even without a care plan

Not everyone wants a monthly retainer. That's fine. You can still take real steps to stop WordPress hacks yourself, if you actually keep the habit going.

Weekly, check your plugin list for update notices. Log in and look. Don't rely on an email you might skim past. Two minutes, once a week, catches most of what matters.

Monthly, check who has admin access. Remove anyone who shouldn't still have it. Check that your backup ran and that you can actually see a recent, restorable copy.

Monthly is also when you should scan for unfamiliar files in your uploads folder. Malware often hides there because it looks like ordinary media. A quick look catches what a casual glance misses.

None of this replaces proper monitoring. But it's far better than nothing, and it's the minimum bar if you're serious about wanting to stop WordPress hacks on a site you manage yourself.

What monitoring actually catches that set-and-forget misses

A lot of site owners think "I installed a security plugin, so I'm covered." That's set-and-forget thinking. It's not enough on its own to stop WordPress hacks that are already probing your site.

Monitoring means someone — or something reliable — is actually watching. It catches a file that changed at 3am when nobody touched the site. It catches a new admin account that nobody on the team created.

It catches traffic patterns that look wrong before they turn into an outage. A sudden flood of requests to one script. A crawler hitting login pages hundreds of times an hour.

A set-and-forget plugin scans on a schedule and hopes it catches things in time. Real monitoring flags changes as they happen. That gap, hours or days versus real time, is often the difference between a quick fix and a full clean-up.

That's the real value of ongoing care. It's how you stop WordPress hacks from turning into full clean-ups, not just how quickly you notice one after the fact.

How a firewall stops attacks before WordPress ever sees them

A firewall sits in front of your site, not inside it. Requests get checked before they ever reach WordPress. Bad ones get blocked at the door.

This matters because most attacks aren't a person typing commands. They're automated scripts, hitting thousands of sites an hour, looking for known weaknesses. A firewall recognises the pattern and stops it cold.

Brute-force login attempts get blocked after a few tries, not a few thousand. Known malicious IPs get blocked outright. Requests trying to exploit a specific plugin vulnerability get rejected before WordPress even processes them.

This is a big part of how you stop WordPress hacks at scale. Instead of cleaning up after every attempt, most attempts never get anywhere near your files or database.

It's not a silver bullet on its own. But paired with real hardening behind it, a firewall removes the vast majority of noise — the everyday scanning and probing that never really stops on any public website.

Why the sites that never get hacked twice share the same traits

I've cleaned up plenty of sites that got hacked once, fixed the surface issue, then got hacked again months later. I've also worked with plenty that never had a second incident. The difference isn't luck.

The sites that stay clean treat the first hack as a wake-up call, not bad luck. They find the actual entry point. They close it properly, not just the symptom that happened to be visible.

They also stop treating security as a one-time project. Updates happen on a schedule. Someone is watching, even quietly, in the background. Nothing gets left "for later," because later has a habit of becoming never.

Access stays tight too. Fewer admin accounts. Stronger, unique passwords. No shared logins passed around a team over email or chat.

Put together, none of it is complicated. It's consistency. The sites that manage to stop WordPress hacks for good are the ones where someone keeps doing the boring stuff, month after month, without waiting for a reminder.

What to do differently after a second hack

A first hack is a bad day. A second hack is a pattern. If it's happened twice, something structural is wrong, not just unlucky timing.

The first thing to do differently is stop assuming the previous clean-up found the real root cause. If the same site got hit again, it probably didn't. Something was missed the first time.

That means a deeper look this time. Every plugin gets reviewed, not just updated. Every user account gets checked, not assumed safe. Server-level access gets reviewed too, not just the WordPress dashboard itself.

A second hack is also the point to stop managing security alone if that's what you've been doing. It's a clear sign the current approach isn't working, however much time it's taking up.

Most importantly, a second hack means ongoing monitoring stops being optional. A one-off clean-up got you here twice already. To actually stop WordPress hacks from becoming a recurring cost, something has to change about how the site gets watched between incidents, not just how it gets cleaned.

Is your current setup actually protecting you, or does it just look like it is?

Plenty of sites have a security plugin installed, a green checkmark showing, and an owner who feels covered. That feeling isn't the same as being protected.

Ask yourself a few honest questions. When was the last time someone actually looked at your site's logs? Not the plugin's summary — the real logs. If the answer is "never," that's worth noting.

Ask whether your backups have ever been tested by actually restoring one. A backup you've never restored is a guess, not a safety net.

Ask who has admin access right now, and whether you could name every person on that list without checking first. If you can't, that's an open door you don't even know about.

None of this means your current setup is useless. It might be doing exactly what it should. Answering these honestly is the real test of whether your setup can stop WordPress hacks, or just makes hacks less visible until they happen anyway.

The traits attackers look for, and how to stop giving them away

Attackers mostly aren't targeting you specifically. They're scanning for weaknesses across huge numbers of sites at once, and yours is simply one of many.

Outdated plugins are the biggest tell. A plugin with a known, unpatched vulnerability is an open invitation, and automated scanners find it fast.

Weak or reused passwords are another. If your WordPress password matches one used somewhere else that's already been breached, that combination is likely sitting in a leaked list somewhere.

Old themes and unused plugins sitting inactive are a quieter risk. Even disabled, they can still carry a vulnerability that gets exploited. If you're not using it, removing it is safer than leaving it dormant.

Fixing these doesn't take special skill. It takes attention. Every outdated plugin closed, every reused password changed, every unused theme deleted, is a small step that helps stop WordPress hacks before an attacker ever gets a foothold. It's not glamorous work. It's just work that has to actually happen.

What skipping this actually costs you later

None of this feels urgent while nothing's wrong. That's exactly why it's easy to skip, and skipping it is how sites end up unable to stop WordPress hacks before they've already lost something.

A hacked site doesn't just need cleaning. It often needs re-submitting to search engines. It may need explaining to customers why the site looked strange or threw warnings for a while.

Downtime during a clean-up is lost time, not just lost traffic. Whatever the site does for your business, whether that's bookings, enquiries, or sales, stops working while it's being fixed.

There's also a trust cost. A visitor who hits a malware warning once often doesn't come back to check whether it's been fixed. They just leave, and they don't return.

Compare that to the quiet, unglamorous cost of monthly maintenance. It's smaller, it's predictable, and it's the actual way you stop WordPress hacks from turning into a bigger, more expensive problem later.

If you can only do a handful of things, do these first

Not every site owner has time for a full checklist every month. If that's you, prioritise a short list instead of doing nothing at all.

Keep WordPress core, plugins, and themes updated. This single habit closes more doors than almost anything else you could do.

Use a unique, strong password for the admin account, and turn on two-factor authentication if your setup supports it. This blocks the majority of automated login attempts outright.

Keep a working backup stored somewhere off the server itself. If everything else fails, a good backup means a hack is an inconvenience, not a disaster.

These three habits alone won't replace proper monitoring or a firewall. But they go a long way toward helping you stop WordPress hacks with the time you actually have, rather than the time you wish you had.