Keeping WordPress secure

Most WordPress hacks are not clever, targeted attacks — they are automated bots scanning for sites running outdated software or weak passwords. That is good news, because it means a short checklist of sensible habits blocks the overwhelming majority of threats. This guide covers what you control inside WordPress, and the platform-level protection Internext adds on top.

1 — Keep core, plugins and themes updated

This is the single most important step. When a security flaw is found in WordPress core or a plugin, a fix is released quickly — but bots race to exploit sites that haven't updated. Log in to wp-admin regularly and apply every available update, or enable automatic updates for minor releases and trusted plugins.

2 — Use a strong admin login

• Never use admin as your username — create a unique administrator name instead.
• Set a long, unique password and store it in a password manager.
• Enable two-factor authentication with a security plugin for an extra layer on wp-admin.

3 — Limit login attempts

Brute-force attacks guess passwords by trying thousands of combinations. A login-limiter or security plugin locks out an IP after a few failed attempts, which stops these attacks in their tracks. Many all-in-one security plugins include this alongside a firewall.

4 — Remove unused plugins and themes

Every plugin and theme is code that could contain a vulnerability, even when deactivated. Delete anything you are not actively using, and only install plugins from the official WordPress repository or trusted developers. Fewer moving parts means a smaller attack surface.

5 — Use HTTPS everywhere

Your Internext account includes free SSL, so make sure it is active and force all traffic to https://. This encrypts logins and any data your visitors submit. See how free SSL works on Internext to confirm and enforce HTTPS.

6 — Take regular backups

Even a well-secured site can have a bad day. Keep recent backups of both your files and database so you can roll back quickly. Internext takes daily off-server backups automatically — see restoring from a daily backup — and keeping your own periodic copy is wise too.

The protection Internext runs for you

Security is a partnership. While you harden WordPress itself, our platform adds server-level defence on every plan:

• Imunify360 — real-time malware scanning, a web application firewall and proactive defence that blocks known attacks before they reach your site.
• CloudLinux — account isolation so each customer runs in a secure, resource-limited container; a problem on one site cannot spill over onto yours.
• LiteSpeed — a fast, secure web server that handles traffic efficiently and works well with WordPress caching.

Frequently asked

What is the single most important step?

Keeping WordPress core, plugins and themes updated. The vast majority of hacked sites were running outdated software with a publicly known, automatically exploited flaw.

Do I still need a security plugin if the server is protected?

Yes — they work together. Server tools stop many attacks, but you should still update software, use strong logins and limit login attempts inside WordPress.

Related guides