Self-hosted WordPress sites are oftentimes self-managed, meaning it’s up to you to keep your site secure.

WordPress security can be as easy as keeping WordPress, your theme and the plugins up to date, but what else can you do to protect your site?

In this post, I list the most important security practices for keeping WordPress safe.

Essential WordPress Security Best Practices to Follow

1. Choose a Reputable WordPress Host

Your host is in charge of maintaining the server your WordPress site is installed on, keeping it up and running so your site is always accessible.

Part of what keeps your server operational is server security.

It’s different between WordPress hosts, but common security practices they use include server-side firewalls to block malware before it even reaches your site’s file system and brute force protection to protect your site from orchestrated attacks known as “DDoS attacks” (distributed denial-of-service attacks).

Make sure any host you’re interested in offers this kind of protection.

2. Update Themes and Plugins Regularly

WordPress plugins are the biggest security risk to WordPress sites. If you don’t keep them up to date, you run the risk of creating bugs and security holes that leave your site vulnerable to attacks.

The same goes for outdated themes.

By keeping every theme and plugin you have installed up to date, you can easily protect your site from some of the biggest threats that impact WordPress sites.

Follow these practices:

• Update themes and plugins on a regular basis. Review them weekly at best; monthly at worst
• Install security patches immediately
• Test updates with a staging site before pushing them to the production version of your site
• Keep up with announcements from the developers of the themes and plugins you use by…
  • …joining their email lists
  • …subscribing to them on social media

3. Keep WordPress Core Up to Date

This isn’t as much of an issue these days thanks to automatic WordPress updates, but it’s still worth mentioning.

Because updates to WordPress itself (known as “WordPress core”) often contain bug fixes and security patches, it’s best to update WordPress as soon as you can.

Critical security patches should update automatically on their own, but make sure new WordPress versions are compatible with your theme and plugins before you upgrade to them.

4. Choose Reputable Themes and Plugins

Keeping themes and plugins up to date isn’t as effective of a security practice if they were malicious or poorly coded to begin with.

This is why it’s also important to ensure the themes and plugins you want to install have good reputations.

Check out their pages from wherever you’re installing or downloading them from. This includes WordPress.org, ThemeForest, CodeCanyon and Creative Market.

Make sure they have decent recent reviews and have been updated within the last 12 months.

5. Install WordPress Plugins Sparingly

According to a statistic about WordPress security from Wordfence, 96% of the security vulnerabilities Wordfence discloses to developers originate from third-party plugins.

This means the more plugins you install on your site, the higher the risk you have of installing a plugin that becomes poorly maintained, either by you or its developer.

Solve this issue by keeping the number of plugins you install to a minimum and only install a plugin if you truly need it.

6. Remove Unused Plugins

Uninstall plugins you no longer need or only periodically need.

For example, if you install a plugin to optimize your database, use it, then uninstall it until you need to optimize your database again.

There’s no sense in maintaining updates for plugins you don’t need on continuous bases.

7. Audit Plugins Annually

Review the plugins you have installed at least once a year.

Make the following checks with each one:

• Whether or not you still need it
• The last time it’s been updated by its developer
• Recent reviews

If you no longer need a plugin, uninstall it.

If a plugin hasn’t been updated since the last audit you made, it may have been abandoned. Consider replacing it if you still need the features it offers.

If recent reviews point toward quality issues, consider if they’re severe enough to warrant switching to a new plugin.

8. Secure Your Login Information

Your login information consists of the following:

• Username you use to log into WordPress
• Password you use to log into WordPress
• Email address you associate with your admin account

Starting with your username, don’t use “admin” or something that’s easily recognizable, such as your email address.

Use a password generator to create a secure password, and use a password manager to save your login information so you don’t need to remember it or write it down.

Keep your email account secure as well. Use a secure password and multifactor authentication.

9. Hide the WordPress Login Page

By default, WordPress users must visit domain.com/wp-login.php in order to log into their sites.

The problem is anyone can use this page to access your login form, including hackers.

Hide your login page by changing its URL to something else, something only you and your team know. WPS Hide Login is a fantastic plugin to use for this purpose.

10. Assign WordPress Roles Carefully

When you invite other users to work on your WordPress site, be careful about which user role you assign them.

If an individual isn’t a business partner or a developer you hire to work on your site, don’t assign them the Admin role.

Give editors the Editor role, but give all other writers the Author or Contributor roles.

If you or your editor don’t mind the extra work, consider uploading articles on behalf of your writers. That way you don’t need to assign them a role at all.

Assigning roles in this way prevents bad actors from having too much access when they interact with the backend of your WordPress site.

Delete inactive users, especially developers you no longer work with.

11. Update Your Site’s PHP Version

WordPress sites are built with a few different programming languages, one of which is PHP.

There are multiple versions of PHP, and switching between them is as simple as selecting a different option from your host’s control panel (after confirming that your theme and plugins are compatible with the version of PHP you want to switch to).

It’s best to use PHP 8.3 for performance reasons, but PHP 8.2 and later are fine.

Avoid using PHP 8.1 and earlier as these versions are no longer supported and leave your site open to security risks.

Unfortunately, more than 21% of WordPress sites are still running PHP 7.4, according to statistics from WordPress themselves.

12. Add Captcha Checks to Forms

Captcha is a security test you’re already familiar with. It’s the little challenge you need to complete to prove that you’re human when you use a form online.

Implementing captcha on your forms can reduce the number of bots who fill out your forms, including your login form if they discover your login page.

13. Implement a Web Access Firewall (WAF)

You can implement your own web access firewall (WAF) as well.

Install a security plugin, such as Wordfence, to activate a WAF on your site.

Your host might even handle this aspect of WordPress security for you.

14. Scan Your Site for Malware Regularly

Protecting your site from malware involves multiple steps:

1. Preventing it from infecting your site in the first place
2. Detecting it as soon as possible
3. Removing it swiftly

A good host, regular WordPress updates, mindful plugin practices and a WAF do a lot to prevent your site from getting infected, but how can you be sure that you’re safe?

Similar to a PC, malware scans detect malware, giving you the opportunity to isolate and remove it.

WordPress security plugins offer this feature, and it’s another issue some hosts handle on behalf of their customers.

15. Keep Backups

If all else fails, you can always revert to a backup of your site, one that was taken when everything was working correctly.

It’s best to take backups on a daily basis since things can go wrong any day of the week whether you’re editing your site or not.

Backup plugins offer a solution to this issue, and most WordPress hosts offer backups as well.

Third-Party Security Options for WordPress

You don’t need to handle WordPress security all on your own. The good thing about using a platform as popular as WordPress is it has a lot of third-party options you can use for help maintaining your site.

For WordPress security, these options include:

• WordPress hosting
• WordPress security plugins
• WordPress backup plugins
• WordPress maintenance services

There’s a type of WordPress hosting called “managed WordPress hosting.”

With this type of hosting, your host manages numerous aspects of WordPress maintenance for you, including installing WordPress on your server, implementing caching for performance, implementing an advanced WAF, monitoring for security issues, handling security issues, and taking and storing backups.

WordPress security and backup plugins help you manage WordPress security on your own.

WordPress maintenance services are hands-on services that handle most, if not all, aspects of WordPress security for you, including WordPress updates.