WordPress powers a huge share of the web, which makes it a top target for automated attacks. These steps dramatically reduce your risk.

The Essentials

• Update everything: WordPress core, themes, and plugins — most hacks exploit known, already-patched vulnerabilities.
• Use strong passwords: for wp-admin, your client area, FTP, and email. Never reuse them.
• Install SSL: a free Let’s Encrypt certificate encrypts logins — see our SSL guide.
• Remove unused plugins and themes: even deactivated code can be exploited.

Recommended Steps

• Limit login attempts: a plugin like Limit Login Attempts Reloaded blocks brute-force attacks.
• Change the default admin username: never use “admin” — it is the first username bots try.
• Add two-factor authentication: plugins like Wordfence Login Security add 2FA to wp-admin.
• Install a security plugin: Wordfence or Solid Security provide firewalls and malware scanning.

Server-Level Protection

• The Plesk WP Toolkit’s Security check can apply recommended hardening automatically — look under WordPress → your site → Security.
• Keep regular backups (see our Plesk backup guide) so you can recover quickly if the worst happens.

Think your site may already be compromised? See our guide on what to do if your website gets hacked.