Secure WordPress and keep its access under control

WordPress security depends on maintenance, permissions and the ability to recover the site. These measures complement each other; none of them on its own guarantees there will be no intrusion.

Maintain the core, plugins and themes

Check updates and security notices for the installed components. Before a major change, keep a verifiable backup and test the critical features in staging. Do not leave a known vulnerability open indefinitely for fear of updating: prepare a controlled fix or replacement.

Remove components you do not use, including deactivated plugins that are still on disk. Check each plugin's maintenance, its source and its compatibility; an old date alone does not prove it has been abandoned.

Accounts and recovery

Use one account per person with the minimum role needed. The standard Editor role does not need to install plugins or manage users; check capabilities added by extensions and accounts that should no longer have access.

Assign long, unique passwords and enable 2FA for anyone who administers the site. Keep the recovery methods offered by the integration outside WordPress and test them. 2FA on the client area does not automatically enable it on your website.

Check sessions, application passwords and integration tokens. When a collaborator leaves, also revoke the access they had to the hosting and deployment, as appropriate.

Protect the login form

Limit login attempts and review lockouts so you do not block legitimate access. You can change the login path with a compatible plugin, but do not rename wp-login.php.

HTTP authentication or an IP restriction can add another layer, but they must be tested with AJAX, password recovery and integrations. Protect sensitive endpoints without opening general exceptions to fix a single failure.

Choose controls and watch for changes

Check what each security plugin adds. Avoid duplicating resource-heavy scans and keep specific controls such as 2FA or change logging when they meet a real need.

Watch for new administrators, plugin installations, modifications and unexpected outgoing email. An alert deserves investigation; deleting the file or dismissing the warning is not enough.

Backups and responding to an intrusion

Keep files and database in independent backups and test restoring them. A backup kept only inside the public directory can be exposed or altered along with the website.

If you suspect a compromise, preserve evidence, limit access and follow the WordPress clean-up guide. Updating after an attack does not automatically remove backdoors or added users.