Skip to content
OrbixPanel OrbixPanel Tutorials

Secure a WordPress site

WordPress runs a huge share of the web, which makes it the biggest target. Most hacks exploit the same few weaknesses — close them and you’re ahead of the vast majority of attacks.

The high-impact basics

  • Strong admin login. A unique strong password, and don’t use admin as the username. Add two-factor with a plugin.
  • Limit login attempts. A login-limiter plugin (plus server-level fail2ban) stops password guessing.
  • Keep everything updated. Core, themes, and plugins — outdated plugins are the #1 WordPress attack vector. Watch security advisories.
  • Delete what you don’t use. Every inactive plugin/theme is still code on disk. Remove them, don’t just deactivate.

File & config hardening

  • Correct permissions — files 644, folders 755, never 777. See fix permission errors.
  • Protect wp-config.php — keep it readable only by the site, and move secrets to the environment where you can.
  • Disable file editing in the dashboard: 
    define('DISALLOW_FILE_EDIT', true);
    so a compromised login can’t edit theme/plugin code from the admin.

Server-level protection

  • HTTPS everywhere — free SSL, auto-renewed.
  • Scan for malware regularly with the built-in malware scanner.
  • Automated backups so you can roll back a hacked site — backups & restore.

If it’s already hacked

  1. Take it offline or restore a clean backup.
  2. Scan for malware and quarantine infected files.
  3. Reinstall core + affected plugins/themes fresh.
  4. Rotate all passwords and the database password.
  5. Patch the entry point (usually an outdated plugin), then rescan.

Running OrbixPanel? SSL, malware scanning, fail2ban, and backups are all built in. OrbixPanel.com → — the free, self-hosted, AI-powered hosting control panel.