Secure WordPress in layers, in the right order: first confirm whether the problem is an outage or a compromise, then preserve files and the database, update trusted software, tighten access, and test recovery. A security plugin or WAF can reduce risk, but it cannot replace updates, strong passwords, least-privilege roles, or usable backups.
If you are choosing hosting, ask the provider what it backs up, how often copies are made, how long they are kept, what restoration costs, and whether support includes SFTP and malware assistance. Keep the written plan terms, renewal terms, refund rules, acceptable-use policy, and security exclusions before paying.
Key takeaways
- Record symptoms and preserve both files and the database before cleaning.
- Update WordPress, plugins, and themes after checking that no active destructive incident is underway.
- Use unique administrator passwords, 2FA, least-privilege roles, SFTP, and limited file permissions.
- Keep at least three backup copies in separate places and test a restoration.
- Treat scanners, WAFs, host backups, and security claims as limited controls, not guarantees.
Secure WordPress In The Right Order: What To Do Today
Start by deciding whether the site is compromised, redirected, showing a browser warning, sending spam, or simply unavailable. Record the visible symptoms, the first known time, recent plugin or theme changes, and the hosting environment. A sudden outage may need host support, while injected pages, unknown users, changed files, or spam messages need security handling.
Before cleaning, take a backup or snapshot of both the site files and the database. The files contain WordPress core, plugins, themes, uploads, and configuration. The database contains posts, pages, users, settings, and other site data. One without the other may not restore the site properly. Preserve the infected state when possible so the host or a specialist can investigate it.
If the site is not in the middle of an active destructive incident, update WordPress, plugins, and themes. WordPress says the latest major release is the only officially supported version, so older branches may not receive security fixes. Install software from WordPress.org or a trusted developer, because plugins are additional PHP software and can be incompatible or poorly maintained.
Remove unused plugins, themes, and users. Change administrator passwords to long, unique passwords, then enable two-factor authentication for every administrator. WordPress core does not include 2FA, so you need a plugin or identity provider. Review each account’s role and remove access that is no longer needed.
Ask the host whether the exact plan includes usable backups, SFTP, malware assistance, and restoration help. Confirm the written backup frequency, retention period, restore process, and restore fee. If the current host cannot provide a workable recovery path, plan a move only after you have a clean backup and have checked the new host. Before switching, follow the steps to move a WordPress site to a new host.
How Should You Handle Updates, Logins, Roles And Plugins?
Keep WordPress core, plugins, and themes current, but take a backup before a major change and check the site afterward. WordPress introduced automatic plugin and theme updates in version 5.5. When enabled, they normally run twice daily, although hosting settings or another plugin can disable or interfere with them. Automatic updates reduce delay, but they do not prove that every update is compatible with the site.
Use a staging copy when the host provides one and the change could affect a store, membership system, or custom theme. After updating, check the homepage, contact forms, checkout, login, media, and any key integrations. If something breaks, restore the tested backup or roll back the specific update if the host or plugin provides a supported method. Do not delete the old site or cancel the former host until the replacement and its data have been checked.
Use a separate, unique password for every administrator account. WordPress warns against short passwords, dictionary words, and passwords based on a person’s name, company, or website. Add 2FA for every administrator, not only the account owner. If an account may have been exposed, change its password after the site is clean and update related credentials, including the database password where appropriate.
Give each user the least powerful role that permits the work. An Administrator can manage the whole single-site installation. An Editor can manage content but not plugins or themes. An Author can publish that user’s own posts, while a Subscriber can manage only the profile. Review the user list regularly and remove accounts that no longer need access.
Use SFTP instead of unencrypted FTP when the host provides it. Limit file write access according to the server setup. WordPress gives directory permission 755 and file permission 644 as one possible general scheme, but those values are not universal. When appropriate, set DISALLOW_FILE_EDIT to stop a logged-in attacker from using the dashboard editor. That setting does not block every way of uploading a malicious file.
Install only software from WordPress.org or a trusted developer. Check whether a plugin is compatible with the current WordPress version and whether its maintenance fits the site’s needs. Remove unused plugins and themes instead of leaving them inactive, because old software can still add risk.
How Do You Make Backups That Can Actually Restore The Site?
A backup is a recovery copy, not a barrier against an attack. A normal full WordPress restore needs both the database and the site files, including core, plugins, themes, uploads, and configuration files. WordPress recommends keeping at least three backups in different places or on different media.
Choose the interval based on how much recent work you can afford to lose. A site that publishes daily or processes orders needs more frequent copies than a brochure site that changes once a month. The schedule should cover the database and files, and copies should be kept separately from the live server so one account problem does not affect every copy.
Ask the host exactly what the backup covers, how often it runs, how long copies remain available, whether backups are off-server, and whether restoration costs extra. A host copy may require a support request and may not provide immediate recovery. Keep a separate copy that you can access without relying on the host.
Test a restoration this week. Use a staging site or another safe location, restore the files and database, and check logins, content, forms, images, and important transactions. If the restore fails, record what is missing and ask the host or backup provider how to correct it. Do not cancel the old hosting account until the replacement backup and live site work as expected.
For a move, keep a clean backup, administrator credentials, database credentials, DNS access, and a record of email accounts. Confirm whether the migration includes email and DNS or only WordPress files. The Web Hosting Renewal Prices guide can help you check the cost of staying with a host before you commit to a new term.
What Do Security Plugins, Scanners And WAFs Do?
A malware scanner looks for suspicious or changed files and other indicators. It can identify a problem that needs review, but a scan can miss a compromise or flag a file that is legitimate. A scanner is evidence for the next action, not a guarantee that the site is clean.
A web application firewall, or WAF, filters traffic or requests before they reach the application or server. It can block known malicious patterns, rate-limit requests, and reduce some brute-force traffic. Its protection is limited to what the firewall can see. It does not correct a stolen password, a compromised administrator account, malicious files already on the server, or every application-level problem.
A security plugin may combine scanning, firewall rules, login protection, 2FA, vulnerability alerts, file-change monitoring, and rate limiting. These features can make routine monitoring easier, especially for an owner who needs alerts in one place. The plugin still does not replace updates, least-privilege accounts, independent backups, or cleanup work after an intrusion.
A host may provide server-level controls, backups, malware scanning, or managed updates. Ask which product family and exact plan includes each feature. Shared hosting, managed WordPress hosting, cloud hosting, and VPS plans can have different backup rules, support hours, email limits, inode limits, migration scope, and restore fees. “Unlimited” must be read with the plan’s fair-use or inode terms.
Use a free plugin when you can review alerts and act on them. Paid monitoring or managed incident response can fit a business where downtime costs more than the service, but the contract matters. Ask whether support covers one WordPress installation or every site on the account, whether cleanup is included, and what happens when the site is larger than the stated limit.
Wordfence And Sucuri: Features, Costs And Limits
Wordfence lists a free tier with malware scanning, an endpoint firewall, 2FA, and brute-force protection. Its vendor pages state that firewall rules and malware signatures in the free tier are delayed by 30 days. That delay matters when you want current threat intelligence as soon as Wordfence publishes it.
Wordfence’s paid Premium, Care, and Response products add real-time firewall rules and signatures, with higher tiers adding monitoring, audit work, and incident assistance. The exact US annual amount, renewal amount, billing channel, and refund terms should be confirmed with Wordfence before purchase. The annual amount due is not the same thing as a monthly payment, even when a monthly equivalent is shown.
Wordfence Care and Response apply to a defined WordPress installation rather than every application or every site on a server. The service agreement says Care covers one isolated Linux-hosted WordPress installation and excludes Windows-hosted sites. It also says larger sites and staging or development sites may carry extra charges in specified circumstances; check the current amounts in the service agreement before buying. Wordfence's pricing page, read October 31, 2026, listed Premium at $149 per year, Care at $590 per year and Response at $1,250 per year.
Wordfence says its service will not update WordPress core, themes, or plugins other than Wordfence. That leaves you responsible for a part of ongoing maintenance unless another service handles it. Ask what installation, monitoring, cleanup, response time, staging, and storage conditions apply to the exact plan.
Sucuri describes its product as a cloud WAF and intrusion-prevention service, monitoring service, and malware-cleanup platform. Its technical material describes the WAF as a reverse proxy that inspects incoming HTTP and HTTPS requests before they reach the server. Sucuri advertises unlimited malware-removal requests, 24/7/365 ticket-based support, and a 30-day refund guarantee on its product page.
Sucuri’s product page does not show a dollar price. Request the current US plan price from Sucuri before purchase, then confirm the annual plan, renewal amount, refund eligibility, resource limits, exclusions, and billing channel in writing. Treat performance and security statements as provider claims unless a named independent measurement documents the method, plan, and date.
Neither service guarantees that WordPress cannot be hacked or go down. Choose the product that matches the task you can perform, the support you need, and the cost of downtime. A free plugin may fit a low-risk site with an attentive owner. Managed response may fit a business that needs help during an incident, but the contract’s site, size, platform, and support limits decide whether it applies.
What Should You Do After A Hack Or Malware Warning?
Record what happened, when it began, visible symptoms, recent changes, and the hosting environment. Preserve a backup or snapshot that includes the infected state where possible. Contact the host because a compromise may affect other sites or the server, not only the visible WordPress installation. Do not overwrite evidence before you have preserved a copy.
Scan the site with more than one suitable method when possible, and scan the local computer used to administer it. A stolen administrator password or infected local computer can reintroduce malicious files after a server cleanup. If a known-clean backup exists, restore it after confirming that it contains the required database and files. Restoration may remove posts, orders, comments, or settings created after that backup.
If you rebuild files, WordPress recommends replacing the same-version wp-admin and wp-includes directories through FTP or SFTP rather than relying only on a dashboard reinstallation. Review wp-content, .htaccess, index.php, header.php, footer.php, and functions.php. Check for unknown users, scheduled tasks, altered redirects, and unfamiliar plugins or themes.
After cleanup, update WordPress, plugins, and themes. Change passwords again, including the database account where appropriate, and update wp-config.php. Investigate how the attacker entered and remove that path, such as an exposed credential, outdated plugin, unsafe file permission, or unprotected administrator account.
If Google reports a security issue, fix the problem first and request a review through the Search Console Security Issues report. A review asks Google to reassess the remediated site. It is not a cleanup service and does not replace host support or malware removal.
Keep the old environment available until the clean site, DNS, forms, email, backups, and administrator access have been checked. If the host lacks usable backups, SFTP, malware assistance, or restoration help, plan a move with a clean backup and verified destination. If you would rather not maintain the site yourself, compare the best managed WordPress hosting plans and costs.
What Questions Should You Ask Before Paying For Hosting Or Security?
Ask the host to state, for the exact plan, what it backs up, how often copies are made, how long they are retained, where they are stored, how restoration works, and whether a restore costs extra. Ask whether the backup includes both files and the database, whether you can download a copy, and whether support can restore an earlier version.
Ask about SFTP, malware assistance, WAF coverage, plugin and theme updates, support hours, migration scope, email limits, inode limits, fair-use rules, SSL coverage, data-center location, and backup exclusions. Verify those answers against the written plan terms, current acceptable-use policy, and subscription agreement.
Before paying, confirm the exact annual plan, amount due upfront, renewal amount, refund eligibility, cancellation route, and any bonus time separately from paid time. Keep a copy of the terms. For security services, ask whether the plan covers one site, a Linux installation, a specific site size, or a particular billing channel.
Treat vendor performance and security statements as claims unless a named independent measurement gives the method, plan, and date. An uptime guarantee is a contract with conditions and possible credits, not a record that the site stayed online. Compare the written limits and exclusions before purchase, then choose the service whose recovery process you can actually use.
Frequently asked questions
The answers below address the next decisions that follow the checklist.
How do I secure a WordPress website step by step?
Confirm whether the site is compromised or merely unavailable, record symptoms, and preserve both files and the database. Then update trusted software, remove unused access, add unique passwords and 2FA, check file access, establish separate backups, and test a restoration.
What should I do first if my WordPress site has been hacked?
Preserve a backup or snapshot, including the infected state when possible, and contact the host. Record the symptoms and recent changes before cleaning, because replacing files too soon can remove information needed to identify the entry point.
Do I need a WordPress security plugin?
You may need one if you want scanning, login protection, 2FA, file-change alerts, or firewall controls in one place. The plugin remains an additional layer, so it does not replace updates, least-privilege roles, independent backups, or incident cleanup.
How often should I back up my WordPress site?
Back up often enough that the amount of recent work you could lose is acceptable. A frequently updated store or publication needs a shorter interval than a site that rarely changes, and every schedule should include both files and the database.
Can a firewall or security plugin stop every WordPress attack?
No. A WAF filters traffic it can see, while a plugin may add scanning and login controls, but neither fixes stolen credentials, compromised accounts, malicious files already on the server, or every application-level weakness.
Are host backups enough for WordPress recovery?
Not always. A host copy may require a support request, have limited retention, exclude parts of the site, or cost extra to restore, so keep a separate copy and test restoration of both files and the database.
Should I use automatic WordPress updates?
Automatic updates can reduce the time that known issues remain unpatched, and WordPress supports automatic plugin and theme updates. Check the site after updates and keep a restorable backup because hosting settings, plugin conflicts, or custom code can interfere.
What is the difference between a malware scanner and a WAF?
A scanner looks for suspicious files and indicators after they exist, while a WAF filters incoming requests before they reach the application or server. A site may need both, but neither proves that all malicious activity has been removed.
When should I pay for managed security?
Pay when the cost of downtime, investigation, or cleanup is higher than the service cost and the contract covers your site. Confirm the plan’s installation type, site-size limit, response time, cleanup scope, support hours, exclusions, annual price, renewal, and refund terms.
Should I move WordPress after a security problem?
Move only after preserving a clean backup and checking the new environment. Confirm that the destination supports the required WordPress version, SFTP, email accounts, DNS, backups, restoration, and malware assistance before cancelling the old service.
Start with the controls you can verify today, then test whether they work. A secure setup is a repeatable process of updates, access review, separate backups, restoration checks, and prompt action when symptoms change.
Find more reviews and guides on Even Reviews. Spotted something to correct? Contact us and include the page title.
