WordPress security is not optional — it is essential. With WordPress powering millions of websites, it is a frequent target for automated attacks, brute-force login attempts, and malware injections. At SakuraHost, we implement server-level protections, but securing your WordPress installation requires action on your part as well. This comprehensive guide covers the most critical security measures every WordPress site owner should implement.
Why WordPress Sites Get Hacked
Most WordPress hacks are not targeted attacks. They are automated bots scanning the internet for known vulnerabilities. The most common entry points include:
- Outdated WordPress core, themes, or plugins
- Weak passwords and default usernames
- Insecure hosting environments (not an issue with SakuraHost)
- Nulled or pirated themes and plugins containing backdoors
- Lack of SSL encryption
1. Keep Everything Updated
The single most important security measure is keeping WordPress, your themes, and all plugins up to date. Over 50% of WordPress hacks exploit known vulnerabilities in outdated software.
Add the following to your wp-config.php to enable automatic core updates:
For plugins, navigate to Plugins > Installed Plugins, and click Enable auto-updates for each critical plugin. Alternatively, configure auto-updates through Softaculous in your SakuraHost cPanel.
2. Use Strong Credentials
- Never use
admin,administrator, or your domain name as a username - Use passwords with at least 16 characters mixing uppercase, lowercase, numbers, and symbols
- Enable two-factor authentication (2FA) using Two Factor plugin or Wordfence
- Use unique passwords for your WordPress admin, cPanel, FTP, and database
3. Install a Security Plugin
A dedicated security plugin provides firewall protection, malware scanning, and login hardening. We recommend these options:
- Wordfence Security — comprehensive firewall and malware scanner with real-time threat intelligence
- Sucuri Security — file integrity monitoring, security notifications, and post-hack actions
- iThemes Security — over 30 security hardening features including brute force protection
4. Limit Login Attempts
By default, WordPress allows unlimited login attempts, making brute-force attacks trivial. Install Limit Login Attempts Reloaded to restrict failed login attempts and temporarily lock out attackers.
5. Change the Default Login URL
Bots target /wp-admin and /wp-login.php by default. Use WPS Hide Login to change your login URL to something custom like /my-secret-login. This dramatically reduces automated brute-force attempts.
6. Harden wp-config.php
Your wp-config.php file contains database credentials and security keys. Protect it with these measures:
Generate fresh security keys using the WordPress Secret Key Generator and replace the existing ones in your wp-config.php.
7. Disable File Editing
WordPress includes a built-in file editor that allows modifying theme and plugin files from the dashboard. If an attacker gains admin access, this becomes a dangerous tool. Disable it:
8. Use SSL Encryption
Every SakuraHost plan includes a free Let's Encrypt SSL certificate. Ensure your site forces HTTPS:
Add to wp-config.php:
Also ensure your WordPress Address and Site Address in Settings > General both use https://.
9. Secure File Permissions
Correct file permissions prevent unauthorized modification. The recommended permissions for WordPress on SakuraHost are:
You can set these via SSH or through File Manager in cPanel. See the WordPress file permissions documentation for details.
10. Regular Backups
No security strategy is complete without backups. Even the most hardened site can be compromised. Use UpdraftPlus to schedule automatic backups to remote storage. SakuraHost also provides server-level backups accessible via your cPanel.
Security Checklist Summary
- WordPress core, themes, and plugins are up to date
- Strong, unique passwords with two-factor authentication enabled
- Security plugin installed and configured (Wordfence or Sucuri)
- Login attempts limited and login URL changed
- wp-config.php protected and file editing disabled
- SSL certificate active and HTTPS forced
- Correct file permissions set
- Automatic backups scheduled to remote storage
For further reading, consult the official WordPress Hardening Guide.