8 Proven Cybersecurity Practices to Protect Your Data

43% of all cyberattacks target small businesses and personal websites. WordPress alone accounts for over 90,000 attacks per minute. If you run a WordPress site, you don’t get to opt out of this problem. Bots don’t care about your traffic numbers. They scan every IP, test every login page, and exploit every unpatched plugin they find.

I’ve cleaned up hacked WordPress sites for clients who thought “it won’t happen to me.” The recovery process is brutal: 4-6 hours minimum, potential data loss, blacklisted by Google, and lost revenue while the site sits offline. The security hardening that would’ve prevented it? About 20 minutes.

I’m going to walk you through 8 proven cybersecurity practices specifically for WordPress site owners. These aren’t theoretical recommendations. They’re the exact steps I implement on every client site, and they’ve prevented thousands of attacks across hundreds of projects.

Understand WordPress-Specific Threats First

Brute force attacks, SQL injection, cross-site scripting (XSS), and supply chain compromises are the four biggest threats to WordPress sites in 2026. Each one exploits a different weakness, and you need to understand them before you can defend against them.

Brute force attacks hammer your wp-login.php page with thousands of username/password combinations per hour. Automated bots cycle through common passwords like “admin123” and “password1.” Without login protection, it’s only a matter of time before they get in.

SQL injection targets vulnerable plugins and themes. Attackers inject malicious database queries through form fields, search boxes, or URL parameters. One poorly coded contact form plugin can expose your entire database, including customer emails, payment data, and admin credentials.

XSS (cross-site scripting) lets attackers inject malicious JavaScript into your pages. Visitors unknowingly execute that code, which can steal session cookies, redirect to phishing pages, or install malware. I’ve seen this happen through comment forms and even through a popular slider plugin that had an unpatched XSS vulnerability for months.

Supply chain attacks are the scariest. A legitimate plugin or theme gets compromised at the source. The developer’s account gets hacked, or a plugin gets sold to a malicious buyer who pushes a backdoor through an “update.” You install the update trusting the source, and now your site is compromised. This happened with the AccessPress Themes breach in 2022, which affected over 360,000 websites.

The 20-Minute WordPress Security Hardening Checklist

You can dramatically reduce your attack surface in under 20 minutes. I do this setup on every new WordPress site before publishing a single page. It’s not optional. It’s the foundation everything else builds on.

Here’s the exact checklist, in order of priority:

1. Change the default admin username. If your admin account is literally “admin,” create a new administrator account with a unique username, log in with it, and delete the old one. This alone stops a huge percentage of brute force attempts.
2. Set a strong password. Minimum 16 characters, randomly generated. Use a password manager to create and store it. No dictionary words, no birthdates, no pet names.
3. Force SSL/HTTPS sitewide. In Settings > General, make sure both WordPress Address and Site Address use https://. Add this to wp-config.php: define('FORCE_SSL_ADMIN', true);
4. Disable file editing. Add define('DISALLOW_FILE_EDIT', true); to wp-config.php. This prevents anyone from editing plugin and theme files through the WordPress dashboard, even if they compromise an admin account.
5. Set correct file permissions. Directories should be 755, files should be 644, and wp-config.php should be 440 or 400. Wrong permissions are an open invitation.
6. Move wp-config.php up one directory. WordPress automatically looks for wp-config.php one level above the root. Moving it there puts it outside the web-accessible directory.
7. Disable XML-RPC. Unless you specifically need it (some plugins require it), disable it. It’s a common attack vector for brute force and DDoS amplification.
8. Add security headers. X-Content-Type-Options, X-Frame-Options, Content-Security-Policy, and Strict-Transport-Security. Your hosting provider or security plugin can handle these.

If you’re building a new website, do this before anything else. Retrofitting security is always harder than building it in from day one.

Security isn’t a product you install. It’s a series of small decisions you make every time you add a plugin, create an account, or skip an update.

Lock Down Authentication: 2FA, Login Limits, and XML-RPC

Your login page is the front door to your WordPress site, and by default, it’s wide open. No rate limiting, no lockouts, no second factor. You need to fix all three.

Enable Two-Factor Authentication (2FA)

Even a 20-character password can be stolen through phishing, keyloggers, or database breaches at other services you use. 2FA adds a second barrier: after your password, you need a time-based code from an authenticator app like Google Authenticator, Authy, or 1Password.

Skip SMS-based 2FA. SIM-swapping attacks can intercept text messages, and they’re more common than you’d think. Use an authenticator app or, for maximum security, a hardware key like YubiKey.

Enable 2FA on every account that touches your site: WordPress admin, hosting panel, domain registrar, email, and any connected services. Start with your email account because that’s the master key attackers use to reset passwords everywhere else.

Limit Login Attempts

WordPress doesn’t limit login attempts by default. An attacker can try 10,000 passwords and WordPress will happily process every single one. Install a plugin like Limit Login Attempts Reloaded (free) or use your security plugin’s built-in feature. I set mine to lock out after 3 failed attempts for 20 minutes, then 24 hours after 3 lockouts.

Disable XML-RPC

XML-RPC (xmlrpc.php) is a legacy API that most WordPress sites don’t need. But attackers love it because it lets them try hundreds of passwords in a single HTTP request using the system.multicall method. Your login limiter won’t even catch it because it bypasses wp-login.php entirely.

Add this to your .htaccess file to block it:

<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>

Or use a security plugin to disable it with one click. If you use Jetpack or the WordPress mobile app, you’ll need XML-RPC enabled, so use a plugin that can selectively allow specific XML-RPC methods instead.

Maintain Plugin and Theme Hygiene

Outdated plugins are the number one attack vector for WordPress sites. Not weak passwords. Not hosting. Plugins. Patchstack’s 2026 security report found that 96% of WordPress vulnerabilities come from third-party plugins and themes.

Here’s the plugin hygiene routine I follow on every client site:

• Update everything weekly. Set a recurring calendar reminder. Check Plugins > Updates every Monday morning. WordPress 5.5+ supports auto-updates for plugins, but I prefer manual updates so I can catch breaking changes.
• Delete inactive plugins immediately. Deactivated plugins still have code on your server. That code can still be exploited. If you’re not using it, delete it. I’ve cleaned up client sites with 20+ inactive plugins, several with known critical vulnerabilities.
• Audit plugins quarterly. For each plugin, ask: Is this still maintained? (Last update within 6 months?) Does it still serve a purpose? Are there better alternatives? Remove anything that fails these checks.
• Vet new plugins before installing. Check the last update date, active installs, support forum activity, and developer reputation. A plugin with 50 installs and no updates in 2 years is a liability, not a feature.
• Never use nulled (pirated) themes or plugins. They almost always contain backdoors. I’ve seen nulled themes that silently create admin accounts, inject spam links into content, and redirect mobile visitors to phishing sites. The money you “save” isn’t worth the risk.

The same rules apply to themes. Keep your active theme updated and delete any themes you’re not using. WordPress only needs one active theme. Everything else is dead weight with potential vulnerabilities.

Choose the Right Hosting and Enable WAF Protection

Your hosting provider is your first line of defense. Cheap shared hosting packs hundreds of sites onto one server with minimal isolation. If another site on your server gets compromised, yours could be at risk too. I’ve seen this happen more than once.

For WordPress sites that handle any kind of business, I recommend managed cloud hosting. You get server-level firewalls, automatic security patches, malware scanning, and proper account isolation. Cloudways is what I use for most client projects. Their Vultr High Frequency servers give you dedicated resources starting at $14/month, with built-in firewalls, automated backups, free SSL, and bot protection through their Cloudflare Enterprise CDN add-on.

Web Application Firewall (WAF)

A WAF sits between your site and the internet, filtering malicious traffic before it reaches your server. It blocks SQL injection attempts, XSS payloads, brute force attacks, and known bad IPs. Think of it as a bouncer that checks every visitor before they walk in.

You have two options:

• DNS-level WAF (Cloudflare, Sucuri): Traffic gets filtered before it reaches your server. Lower server load, broader protection. This is what I prefer.
• Plugin-level WAF (Wordfence): Runs on your server. Easier to set up but uses your server resources and only kicks in after traffic reaches WordPress.

Either option is dramatically better than nothing. If your budget is tight, Cloudflare’s free plan includes basic WAF rules. For serious protection, their Pro plan ($20/month) or a dedicated WAF like Sucuri ($199/year) covers most WordPress-specific threats.

Compare WordPress Security Plugins

A security plugin handles the heavy lifting: firewall rules, malware scanning, login protection, file integrity monitoring, and security hardening. You need one. The question is which one.

I’ve tested all four major options across client sites. Here’s how they actually compare:

Wordfence is the most popular WordPress security plugin with over 4 million installs. The free version includes a server-side WAF, malware scanner, login security, and 2FA. The premium version ($119/year) adds real-time firewall rules, country blocking, and real-time malware signatures. Downside: it runs on your server, so it uses your resources. On shared hosting, this can slow things down.

Sucuri takes a different approach with their DNS-level firewall. Traffic gets filtered before it reaches your server, which means zero performance impact. The platform plan ($199/year) includes WAF, CDN, DDoS protection, and unlimited malware removal with guaranteed response times. I use Sucuri on high-traffic client sites where uptime is critical.

Solid Security (formerly iThemes Security) focuses on hardening and lockdowns. It’s strong on brute force protection, file change detection, and database security. The Pro version ($99/year) adds two-factor authentication, scheduled malware scanning, and password-less login. Good value, but the WAF isn’t as robust as Wordfence or Sucuri.

MalCare runs its malware scanner on their own servers, not yours. This means zero performance impact during scans. The Plus plan ($149/year) includes real-time firewall, automated malware removal, and uptime monitoring. It’s my recommendation for site owners who want strong security without touching server configs.

My pick for most WordPress sites? Wordfence free + Cloudflare free if you’re on a budget. Sucuri platform + Cloudways hosting if you can invest in proper protection. The combination of DNS-level filtering with server-level hardening gives you overlapping layers of defense.

Build a Bulletproof Backup Strategy

Backups are your insurance policy. Even with perfect security, things go wrong: a plugin update breaks your site, a server fails, or an attacker gets through. Without a tested backup, you’re starting from scratch.

Follow the 3-2-1 backup rule:

• 3 copies of your data (the original plus 2 backups)
• 2 different storage types (your server plus cloud storage like Google Drive, Amazon S3, or Dropbox)
• 1 off-site copy (physically separate from your hosting provider)

For WordPress, the two backup plugins worth considering are UpdraftPlus and BlogVault.

UpdraftPlus (free version) handles scheduled backups to remote storage. It supports Google Drive, Dropbox, Amazon S3, and more. The premium version ($70/year) adds incremental backups, database encryption, and multisite support. It’s the most popular WordPress backup plugin for a reason: it works reliably and it’s straightforward to configure.

BlogVault ($89/year) takes a different approach. It runs incremental backups on their servers, not yours, so zero performance impact. Backups happen daily automatically. The restore process is one-click and takes minutes. I use BlogVault on client sites because the restore reliability is excellent, and the built-in staging feature lets you test updates before pushing them live.

Whichever you choose, test your backups quarterly. A backup you’ve never restored is a backup you can’t trust. Spin up a staging site, restore a recent backup, and verify everything works. This takes 15 minutes and could save you days of recovery.

If you’re trying to build a business budget that includes security costs, allocate at least $10-15/month for backup and security tools. That’s $120-180/year to protect an asset that took hundreds of hours to build.

“

I’ve never had a client regret investing in backups. I’ve had plenty regret skipping them.

Monitor Your Site: Uptime, File Integrity, and Security Headers

You can’t fix what you don’t know is broken. Monitoring catches problems before they escalate into full breaches. There are three things you need to watch.

Uptime Monitoring

UptimeRobot (free for up to 50 monitors) pings your site every 5 minutes and alerts you via email, SMS, or Slack when it goes down. Unexpected downtime can signal an active attack, a server issue, or a botched update. I have every client site on UptimeRobot. The free tier is more than sufficient for most WordPress owners.

File Integrity Monitoring

File integrity monitoring compares your WordPress core files, plugin files, and theme files against known-good versions. If an attacker modifies a file (injecting malware or adding a backdoor), you get alerted immediately. Wordfence includes this in its free version. Sucuri’s server-side agent does the same.

Pay special attention to changes in wp-config.php, .htaccess, and any file in wp-includes/. Legitimate updates don’t modify these core files.

Security Headers

Security headers tell browsers how to handle your content. They prevent clickjacking, MIME-type sniffing, and cross-site scripting. Test yours at securityheaders.com. Most WordPress sites score D or F out of the box.

The essential headers to add:

• X-Content-Type-Options: nosniff prevents MIME-type attacks
• X-Frame-Options: SAMEORIGIN prevents clickjacking
• Strict-Transport-Security: max-age=31536000 forces HTTPS
• Referrer-Policy: strict-origin-when-cross-origin controls referrer info
• Permissions-Policy restricts browser feature access

Your hosting provider or security plugin can add these. On Cloudways, you can add them through the Nginx configuration. Most security plugins include a one-click option to set them.

Monitoring also extends to your online marketing strategy. Use Semrush to track your site’s visibility in search. A sudden drop in rankings or indexing can signal that Google has flagged your site for malware or spam injection, both symptoms of a compromised WordPress installation.

What to Do If Your WordPress Site Gets Hacked

If your site gets compromised, speed matters. Every minute your site stays hacked, search engines crawl malicious content, visitors get redirected to phishing pages, and your domain reputation takes damage. Here’s the incident response playbook I follow.

Step 1: Contain the Damage (First 15 Minutes)

• Put the site in maintenance mode or take it offline
• Change all passwords: WordPress admin, hosting panel, FTP/SFTP, database
• Revoke all active sessions (in WordPress: Users > Your Profile > Log Out Everywhere Else)
• Contact your hosting provider and notify them of the breach

Step 2: Identify and Remove the Malware (1-4 Hours)

• Run a full malware scan (Wordfence, Sucuri SiteCheck, or MalCare)
• Check for unauthorized admin accounts and delete them
• Compare core files against originals using wp core verify-checksums (WP-CLI)
• Review recently modified files, especially in wp-content/uploads/ (PHP files shouldn’t be there)
• Check .htaccess and wp-config.php for injected code
• Search database for suspicious content: base64-encoded strings, iframe injections, and script injections

Step 3: Restore and Harden (1-2 Hours)

• If you have a clean backup from before the compromise, restore it
• Update WordPress core, all plugins, and all themes to latest versions
• Delete any plugins or themes you don’t recognize
• Regenerate WordPress security keys (salts) in wp-config.php
• Implement the hardening checklist from Section 2 if you haven’t already

Step 4: Recover Your Reputation (1-7 Days)

• Request a review in Google Search Console if your site was flagged
• Check blacklist status at Google Safe Browsing, VirusTotal, and Sucuri SiteCheck
• Notify affected users if personal data was exposed (GDPR requires this within 72 hours)
• Document what happened and how for future prevention

Secure Your Email and Communication Channels

Your email account is the skeleton key to everything. Password resets, hosting notifications, payment confirmations, client communication. If an attacker compromises your email, they can reset passwords on every other service you use. This is why email security deserves its own section.

For business email, I use and recommend Google Workspace. It starts at $7.20/month per user and gives you custom domain email (@yourdomain.com), built-in phishing protection that catches 99.9% of threats, 2FA with hardware key support, and admin controls for managing team access.

The phishing detection alone is worth the cost. Google processes billions of emails daily, and their machine learning models are trained on more spam data than any other provider. I’ve watched it catch sophisticated phishing attempts that looked identical to legitimate hosting provider emails.

Beyond email, secure your communication channels:

• Enable 2FA on Slack, Zoom, and any team tools. Compromised collaboration accounts give attackers access to shared files, credentials discussed in channels, and the ability to impersonate team members.
• Use unique passwords for every service. A password manager generates and stores them. I use 1Password for business and personal accounts. The $3/month is the best security investment you can make.
• Check Have I Been Pwned regularly. Enter your email at haveibeenpwned.com to see if your credentials appeared in any data breaches. If they have, change those passwords immediately.

Frequently Asked Questions

Security isn’t a one-time setup. It’s a habit. Run updates weekly. Test backups quarterly. Review your plugin list every few months. The 20 minutes you spend on maintenance today prevents the 20 hours you’d spend recovering from a breach.

Start with the hardening checklist in Section 2. That alone puts you ahead of 90% of WordPress site owners. Then layer on a security plugin, proper backups, and monitoring. You don’t need to do everything at once, but you need to start today.

Disclaimer: This site is reader-supported. If you buy through some links, I may earn a small commission at no extra cost to you. I only recommend tools I trust and would use myself. Your support helps keep gauravtiwari.org free and focused on real-world advice. Thanks. - Gaurav Tiwari