Protecting Your WordPress Site
### 1. Keep Everything Updated
Outdated WordPress core, themes, and plugins are the #1 cause of hacked sites.
- Enable **automatic updates** in WordPress Dashboard → Updates
- Remove unused themes and plugins
### 2. Use Strong Passwords
- Use a **password manager** (Bitwarden, 1Password)
- Admin password should be 16+ characters with uppercase, lowercase, numbers, and symbols
- Never use "admin" as your username
### 3. Install a Security Plugin
- **Wordfence Security** (free & paid) — firewall, malware scanner, login protection
- **Solid Security (iThemes)** — security hardening
- **All In One WP Security** — free, comprehensive
### 4. Enable Two-Factor Authentication (2FA)
Require a one-time code in addition to the password when logging in.
- Wordfence has built-in 2FA
- Also available via **WP 2FA** plugin
### 5. Limit Login Attempts
Prevent brute-force attacks by limiting failed login attempts.
- Wordfence handles this automatically
- Or install **Limit Login Attempts Reloaded**
### 6. Regular Backups
Even with all precautions, always have recent backups.
- **UpdraftPlus** — backup to Google Drive, Dropbox, or S3
- Schedule daily backups
### 7. Use HTTPS (SSL)
An SSL certificate encrypts data between the server and visitors.
- Free via Let's Encrypt (we install it for you)
### 8. Hide wp-login.php
Move your login URL to reduce bot attacks:
- Use **WPS Hide Login** plugin
### 9. Disable Directory Browsing
Add to your .htaccess:
```
Options -Indexes
```
### My site was hacked — what now?
1. Open a support ticket immediately
2. We offer malware removal and security audit services
3. We'll clean the site, remove malware, patch vulnerabilities, and harden security