Part of the Website Security Checklist for SEO series. This post is the WordPress-specific deep dive — none of it requires touching code.
Why WordPress Sites Are Targeted So Often
WordPress powers a huge share of the web, which makes it a high-value target purely on volume — attackers write one script and point it at millions of sites. That's not a flaw in WordPress core itself; the platform's security team patches vulnerabilities quickly. The actual risk concentrates almost entirely in three places: outdated plugins/themes, weak login credentials, and misconfigured file permissions. Fix those three and you've closed the doors attackers actually use.
Login & Admin Hardening
Your login page is the most directly attacked surface on the entire site. These changes take minutes and eliminate the most common automated attack pattern (credential stuffing and brute-force):
- Never use "admin" as a username — change it on any legacy install that still has it
- Enforce strong, unique passwords for every account with publishing or admin access
- Enable two-factor authentication (most security plugins include this free)
- Rate-limit or lock out repeated failed login attempts
- Consider moving the login URL away from the default
/wp-adminpath - Remove user accounts for anyone who no longer needs access
Keeping Core, Themes & Plugins Updated
Most WordPress breaches exploit a vulnerability that was already patched — the site just hadn't applied the update yet. This is the single highest-leverage habit on this entire list.
- Enable automatic updates for minor WordPress core releases
- Check for plugin and theme updates at least weekly; apply security releases immediately
- Remove plugins and themes you've deactivated — deactivated still means installed and exploitable
- Before major updates on a business-critical site, test on a staging copy first
Backups: The Non-Negotiable Safety Net
A clean, recent, off-site backup is the difference between a 20-minute recovery and a multi-day crisis. It's also your fastest path back if cleanup ever goes wrong.
- Automated backups run on a schedule — daily for active sites, weekly minimum otherwise
- Backups are stored off-site (cloud storage), not just on the same server
- You've actually tested a restore at least once — an untested backup is a hope, not a plan
- Database and files are both included, not just one or the other
A backup stored on the same compromised server is not a backup. If an attacker gets server access, an on-server-only backup can be wiped or infected along with everything else.
File Permissions & wp-config Protection
Incorrect file permissions are an invisible risk most site owners never check — until something goes wrong.
- Directories set to 755, files set to 644 (never 777)
wp-config.phpis not publicly readable and ideally moved one directory above the web root- Directory listing/browsing is disabled so attackers can't see your file structure
xmlrpc.phpis disabled or restricted if you don't actively use it
Security Plugins Worth Using
| Plugin | Best For | Cost |
|---|---|---|
| Wordfence | Firewall, malware scanning, login security | Free / Paid |
| Sucuri Security | File integrity monitoring, external scanning | Free / Paid |
| UpdraftPlus | Automated, scheduled off-site backups | Free / Paid |
| Limit Login Attempts Reloaded | Brute-force protection | Free |
None of this requires deep technical skill — it's settings and habits. Run through it once today, fold it into the broader security checklist routine, and you've closed off the overwhelming majority of how WordPress sites actually get compromised.
Need Help with SEO, AEO or GEO?
Let's build a visibility strategy that works across Google, AI answers and generative search.
Start a Free Consultation