WordPress itself is secure, but it’s a popular target, and most hacked WordPress sites have one thing in common: something wasn’t kept up to date. This checklist covers what makes the biggest difference.
What we already do for you
Every Fusionhost hosting account is protected by Imunify360 malware and intrusion protection, a firewall and DDoS protection, and is isolated from other customers by CloudLinux. Those protect the server. The steps below protect your WordPress installation.
Your checklist
- Keep everything updated: WordPress, plugins and themes. Turn on automatic updates where you’re comfortable to.
- Remove what you don’t use. Deactivated plugins and themes can still be attacked, so delete them.
- Only install plugins that are maintained. On a plugin’s page, check when it was last updated and how many sites use it. Avoid “nulled” free copies of paid plugins: they often contain malware.
- Use strong, unique passwords and a password manager, and never use “admin” as a username.
- Turn on two-factor authentication for admin accounts with a reputable security or 2FA plugin.
- Give people only the access they need. Writers need the Author or Editor role, not Administrator.
- Use HTTPS everywhere. See forcing HTTPS.
- Make your own backup before big changes. Our backups are weekly. See restoring from a backup.