Protecting Your Website

Every single day, over 30,000 websites are hacked across the internet. From small blogs to large e-commerce platforms, no one is safe. So, protecting your website from hacking is something you need to take seriously.

WordPress now powers over 40% of the entire internet. It’s easy to think, “my website is too small; no one’s going to target me.” But the truth is, if your website is online, it’s already a target.

You may be asking: how do hackers actually hack my website? A more important question is: how do you stop them?

There are also automated bots that scan the web 24/7, looking for any vulnerability on any site, big or small. So every single site is a potential target.

• Most hacks aren’t personal or sophisticated they’re automated bots scanning for known weaknesses like outdated plug-ins and weak passwords, which is why “I’m too small to target” doesn’t hold up.
• A handful of high-impact steps HTTPS, a strong password, two-factor authentication, and limiting login attempts block the vast majority of automated attacks on their own.
• A backup you haven’t tested isn’t a real backup. It needs to be automatic, stored off-site, and proven to actually restore before you need it.
• Hackers aren’t just after your site itself they’re often after what it can do for them: stolen data to sell, your server’s resources, or a platform to attack other people.
• Security isn’t a one-time setup. It’s an ongoing habit of updates, monitoring, and small hardening steps that compound over time.

It’s easy to file “security” away as a someday task until you see what’s actually on the line. If your site gets hacked, here’s what you’re realistically looking at:

• Google blacklisting: browsers can show visitors a red “This site may be hacked” warning, and your search rankings can drop sharply almost overnight.
• Lost revenue and traffic: if you sell anything through your site, a blacklist warning or downtime stops sales dead while it’s in effect.
• Days of downtime: cleaning up an infection properly not just patching the surface symptom often takes longer than people expect, especially without a clean backup.
• Cleanup costs: professional malware removal typically runs $100 $400 for a straightforward case, more if the infection is deep or your backups aren’t reliable.
• Customer and reader trust: if visitor data or payment details were exposed, that damage tends to outlast the technical fix.

None of this is meant to alarm you it’s meant to make the case for why the steps in this guide are worth the hour or two they take. Prevention is consistently cheaper and less painful than recovery.

Before we get into how attacks happen, it’s worth understanding what hackers are actually after. Very few attacks are personal; most are opportunistic, and the motive shapes what a hacker does once they’re in.

Money

This is the biggest driver by far. Hackers monetize a compromised site in several ways: injecting card-skimming code into checkout pages, stealing customer or user databases to sell on dark web marketplaces, locking up your files with ransomware and demanding payment, or quietly installing cryptomining scripts that use your server’s resources for their own profit.

Your site’s reputation and traffic

A hacked site can be used to redirect your visitors to scam pages, inject spammy backlinks to boost someone else’s search rankings, or serve malicious ads that generate click-fraud revenue for the attacker, all while your search rankings and reader trust take the hit.

Infrastructure for bigger attacks

Many hackers don’t want your site itself; they want to use it. A compromised WordPress install can be folded into a botnet, used to send phishing emails or spam that’s harder to trace back to the attacker, or used to host malware for distribution to other victims.

A foothold into something bigger

If your site shares a server, hosting account, or login credentials with other services, a breach can be a stepping stone giving an attacker access to email accounts, other websites, or connected business systems.

Practice, reputation, or ideology

Not every attack is financially motivated. Some hackers deface sites to make a political or ideological statement (“hacktivism”), and some particularly less experienced attackers, sometimes called “script kiddies,” are simply testing automated tools to see what they can break, with no specific target in mind.

Understanding this matters because it explains why “I’m too small to be worth hacking” doesn’t hold up: automated bots don’t check your traffic numbers before attacking, and a small site is just as useful for cryptomining, spam distribution, or credential harvesting as a large one.

Hackers start by scanning websites with tools like Dirb or Nikto, looking for a weakness a way into your website. These tools find outdated plug-ins, open ports, and hidden directories: entry points most website owners would never even notice.

Their first step is to collect information about your domain, subdomains, DNS records, and CMS. They might use a tool like Shodan, among others, to gather your website’s data silently, building a digital map of your system.

Once they’ve found a weak spot, the real attack begins. They may start by uploading a webshell, running a SQL injection, or brute-forcing your admin panel.

All it takes is one outdated plug-in, and a hacker can exploit known CVE vulnerabilities to gain control in seconds. Once they’ve gained access, they rarely stop there. They escalate privileges, inject malware, or create backdoors so they can re-enter your website any time they like even after you think you’ve patched the issue.

This isn’t meant to scare you but you do need to understand that protecting your website has to be taken seriously, and now you know what you’re up against.

Plug-ins

Running an old plug-in that has a known flaw, or simply not updating your plug-ins, is one of the most common ways sites get compromised.

Weak passwords

People tend to use birthdates as passwords or their dog’s name neither of which is ever a good idea.

Too many admin accounts

Every admin account is another possible way in, so the fewer you have, the smaller your exposure. Give people the lowest role that still lets them do their job an Editor can publish and manage content without ever needing full Administrator access. Reserve Administrator for the one or two people who genuinely need it, and remove old accounts (e.g. a former employee or freelancer) as soon as they’re no longer needed.

As mentioned earlier, automated bots are constantly scanning the web. A bot can crack a short password of 6 or 7 characters instantly, or within seconds even if it mixes letters, numbers, and symbols.

Every update to WordPress, your plug-ins, and your themes often includes critical security patches. Running outdated software leaves the door wide open. Staying updated needs to be a constant habit, not a once-in-a-while task.

WordPress also has a built-in editor that lets you change your theme and plugin files right from the dashboard. While that sounds convenient, it’s a huge security risk: if an attacker gets admin access, they can use that editor to inject all sorts of malicious code. The simple fix is to disable it you probably never use it anyway.

By default, your WordPress site also tells the world exactly which version you’re running. That’s a problem because it hands attackers a ready-made roadmap: if they know you’re on, say, version 6.4.1, they can look up every known vulnerability for that specific version. Hiding it makes your site a little less predictable, and a lot harder to target.

You don’t need to touch any code to fix this, but if you’re comfortable with one small edit, the safest method is:

• Connect to your site’s files using your host’s File Manager (in cPanel or your hosting dashboard) or an FTP program like FileZilla.
• Find the file called wp-config.php in your website’s root folder — the same folder as wp-admin and wp-content.
• Open it, and add this line on its own, just above the line that says /* That’s all, stop editing! Happy publishing. */:

define( ‘DISALLOW_FILE_EDIT’, true );

• Save the file and re-upload it if you edited it locally.

That single line removes the “Theme Editor” and “Plugin Editor” options from your WordPress dashboard entirely even for admin accounts.

If editing wp-config.php feels too technical, there’s an easier route: most security plugins (Wordfence and Sucuri Security are both free and popular) include a one-click toggle for this in their settings, usually under a “Hardening” or “Security” tab, labelled something like “Disable File Editing.” That achieves exactly the same result without needing to touch any code.

The real danger isn’t the hacker’s skill it’s not knowing how important it is to protect your website in the first place.

Let’s get into the solutions. We’re going to start with four foundational, non-negotiable security steps:

• Switch to HTTPS, which encrypts everything between your site and your visitors.
• Use strong, unique passwords a password generator makes this easy. Aim for at least 16 characters; the longer the password, the harder it is for a bot to crack.
• Turn on two-factor authentication (2FA).
• Limit the number of login attempts allowed before lockout.

If you do nothing else, do these four things.

Let’s double down on passwords for a second, because they’re still the most common weak link. Two-factor authentication (2FA) means that even if a hacker somehow steals your password, they still can’t get in without a second code from your phone. It’s a genuine game-changer, and one of the most powerful and underrated security tools available.

As mentioned earlier, a common way hackers try to get in is with a brute-force attack that’s a bot trying thousands of password combinations a minute. You can stop that dead in its tracks by simply limiting the number of login attempts. After a few wrong guesses from the same source, they’re locked out. It’s simple, and incredibly effective. A free security plug-in such as Wordfence or Limit Login Attempts Reloaded handles this automatically no coding needed.

By default, every WordPress site’s login page lives at the same predictable address yoursite.com/wp-admin or yoursite.com/wp-login.php. That means automated bots don’t even need to search for your login page; they already know exactly where it is. Moving it to a custom address you choose (e.g. yoursite.com/my-secret-login) removes your site from that automated line of fire entirely.

The easiest way to do this as a beginner is a free plug-in like WPS Hide Login. Install it, set your own custom login address in its settings, and save no code editing required. Just be sure to bookmark your new login URL, since the old one will stop working.

XML-RPC is an older WordPress feature that allows other applications to connect to your site remotely for example, to publish posts from a phone app. Most sites never use it, but it’s still switched on by default, and it’s a well-known target for brute-force and denial-of-service attacks because it lets a hacker try many passwords in a single request instead of one at a time.

Unless you know you specifically need it (check with your theme or app developer if unsure), it’s safe to switch off. A security plug-in such as Wordfence includes a one-click option to disable it under its firewall settings look for “XML-RPC.”

Install a web application firewall (WAF) such as Cloudflare or Sucuri, and run regular malware scans. And, as covered above, hide your WordPress version number if attackers can’t see which version you’re on, they can’t just look up its known vulnerabilities.

The single biggest cause of hacked WordPress sites is outdated software and the easiest way to remove human forgetfulness from the equation is to let WordPress update itself. WordPress already auto-installs minor security releases by default.

To go further, go to Dashboard > Updates and switch “Automatic Updates” on for WordPress itself, and check each plug-in’s row under Plug-ins for an “Enable auto-updates” link. It won’t catch everything major updates can occasionally need manual testing but for most beginner sites, automatic updates close the single biggest gap in this entire article.

Now let’s get a little technical, but stick with me — this is crucial. Think of file permissions as the rules for who can read, write, or run things on your server. Get the rules wrong, and an attacker can take control. You don’t need to be an expert here; just match these settings:

• 644 for files
• 755 for folders
• 600 for your most important file, wp-config.php

That’s essentially telling the server: be extremely strict about who’s allowed to touch this file.

If you’ve never done this before, it’s more straightforward than it sounds. You won’t be editing any code — you’re just changing a setting on each file and folder, and most hosts let you do this in bulk. Here are the two most common ways:

Option 1: Your hosting control panel (easiest for beginners)

• Log in to your hosting account and open File Manager (this is usually inside cPanel, Plesk, or your host’s own dashboard).
• Navigate to your website’s root folder — the same one that contains wp-admin, wp-content, and wp-config.php.
• Right-click a file or folder and look for an option called “Change Permissions,” “File Permissions,” or “CHMOD.”
• You’ll see a box where you can type in the three-digit number (e.g. 755 or 644) or tick read/write/execute checkboxes — either works.
• Some file managers let you apply a change to every file inside a folder at once (“apply to subdirectories” or “recursive”) — useful, but apply folder and file permissions separately, since they use different numbers.

Option 2: An FTP program (e.g. FileZilla, free)

• Download FileZilla and connect to your site using the FTP details from your hosting provider (usually found in your hosting welcome email or dashboard).
• Once connected, you’ll see your website’s files listed on the right-hand side.
• Right-click your root folder and choose “File permissions…”
• Type 755 into the numeric value box, tick “Recurse into subdirectories,” and choose “Apply to directories only.” Click OK.
• Repeat the process, but this time type 644, tick “Recurse into subdirectories,” and choose “Apply to files only.”
• Finally, find wp-config.php on its own, right-click it, choose “File permissions…”, and set it to 600.

A couple of things to know before you start: always take a full backup first, in case anything looks different afterward. And if you’re not confident doing this yourself, it’s completely reasonable to ask your hosting provider’s support team to set these permissions for you most hosts will do this on request, and it takes them a few minutes.

Backups are your digital safety net. A recent, clean backup is the ultimate undo button it’s what lets you recover from a total disaster in minutes instead of days.

But here’s the most important part: a backup you haven’t tested is not a real backup. Backups need to be automatic, stored somewhere safe off-site, and you need to know for certain that you can actually restore from them.

Beyond just having backups, good security is about building habits: regularly checking who’s logging in, running periodic security audits to catch new weaknesses, and staying in the loop about the latest threats in the WordPress world.

If you ever do get hacked, you need a clear, immediate plan of action. Here’s your four-step emergency plan:

• Change every single password admin, database, FTP, all of them.
• Restore your site from your last known clean backup.
• Immediately update WordPress, and all your themes and plug-ins.
• Run a deep malware scan to make sure the threat is completely gone.

Acting fast is what minimises the damage.

Good security is about building a smart, layered system strong foundations, constant vigilance, and ongoing monitoring, all working together to protect your site.

The world of digital threats is always changing, and hackers are getting smarter every day. Your security can’t be a static checklist you set once and forget. It has to be part of how you run your website because in this environment, if you’re standing still, you’re already falling behind.

How do I know if my WordPress site has been hacked?

Common warning signs include unexpected new admin users, unfamiliar plug-ins or files appearing, your site redirecting visitors to another URL, a sudden drop in traffic or search rankings, or a warning from Google in Search Console. If you notice any of these, run a malware scan right away and follow the four-step emergency plan above.

Is WordPress itself safe to use?

Yes WordPress’s core software is actively maintained and patched. Most hacks happen through outdated plug-ins, themes, or weak passwords, not through flaws in WordPress itself. Keeping everything updated closes the majority of these gaps.

How often should I update my plug-ins and themes?

As soon as an update is available, ideally within a few days. Security patches are often released specifically because a vulnerability has already been found, so the longer you wait, the longer your site is exposed.

Do I really need two-factor authentication (2FA)?

Yes. It’s one of the single most effective things you can do, and it takes a few minutes to set up using a free plug-in like Wordfence, Google Authenticator, or your host’s built-in option. Even if a hacker steals your password, 2FA stops them from getting any further.

Can a hacked website recover its Google rankings?

In most cases, yes. Once the malware is fully removed and the site is clean, you can submit a review request through Google Search Console. Rankings typically recover over a few weeks, though the exact timeline depends on how long the site was compromised and how severe the infection was.

Do I need a security plug-in if I already have a firewall?

They cover different things, so it’s worth having both. A web application firewall (WAF) like Cloudflare blocks malicious traffic before it reaches your site, while a security plug-in scans the files already on your server for malware and monitors for suspicious activity like login attempts and file changes.

How much does it cost to fix a hacked WordPress site?

If you have a clean backup, restoring it yourself costs nothing but time. Professional malware removal services typically range from around $100–$400 for a one-time cleanup, though prices vary depending on how severe the infection is and how quickly you need it resolved.