WordPress powers much of the web — which is exactly why it is the most common target. Not from weakness, but from numbers. The good news: most attacks are automatic and stopped by a few basics. Here they are by importance.
1. Strong, unique passwords
Most hacks are simple guesses of a weak password. A long password, different per service, and a password manager stop a huge share of attacks.
2. Two-factor login (2FA)
Even a correct password is not enough if it also needs a phone code. For admin access this is essential.
3. Updates — with a backup first
Outdated WordPress, theme or plugin is the most common open door. Update regularly, but always back up before updating.
4. Limit login attempts
Automated attacks try thousands of passwords. A plugin that blocks after a few failures stops them at the door.
5. Hide the obvious targets
- Do not use the username admin
- Change the default login URL if you can
- Disable file editing from the admin panel
6. SSL across the whole site
The padlock is not only trust — without it passwords travel unencrypted. SSL is free and mandatory today.
7. Regular backups (last line)
If all else fails, the backup saves the business. Automatic, regular, stored off the server. Check at least once that restore actually works.
If you are already hacked
Signs: unknown admins, strange code, redirects, a Google warning. Do not panic: restore a clean backup, change all passwords, update everything, scan. If unsure, get help before doing more damage.