# Secure a WordPress site

> Protect your WordPress site on hosting: keep it updated, guard accounts with strong passwords and two-factor sign-in, remove unused plugins and apply hardening.

Difficulty: Beginner

Attacks on WordPress are automated: bots try known plugin flaws and common passwords on every site they find. A few habits block almost all of them. This guide covers what to do in the WordPress dashboard and, on cPanel, with **WP Toolkit**.

## Before you start

- Make a backup of the files and the database; see [back up and restore your hosting account](/guides/hosting-backup-restore).
- Sign in to the dashboard with an administrator account.

## Step 1: Keep WordPress, plugins and themes updated

- Install updates under **Dashboard › Updates**.
- Under **Plugins › Installed Plugins**, click **Enable auto-updates** for the plugins you trust to update by themselves.
- Replace plugins and themes that are no longer maintained.

**Verify:** **Dashboard › Updates** shows no pending updates.

## Step 2: Protect the accounts

- Use a long, unique password for every administrator; the strength meter on the profile page should show it as strong.
- Do not use `admin` or `webmaster` as a user name.
- Add two-factor sign-in with a plugin for every administrator account.
- Under **Users › All Users**, remove accounts you do not know and give each person the lowest role they need (for example **Editor** instead of **Administrator**).

## Step 3: Remove what you do not use

Deactivate and delete plugins you do not use, and delete themes you do not use (keep one default theme as a fallback). Install plugins and themes only from the WordPress.org directory or the vendor's own site. Never install "nulled" copies of paid plugins: they often contain malware.

## Step 4: Turn off the file editor

The dashboard can edit plugin and theme files. An attacker with an administrator password could use it to add code. Turn it off in `wp-config.php`, above the line `/* That's all, stop editing! Happy publishing. */`:

```php
define( 'DISALLOW_FILE_EDIT', true );
```

**Verify:** the **Theme File Editor** and **Plugin File Editor** entries disappear from the dashboard menus.

## Step 5: Apply the hardening measures in WP Toolkit (cPanel)

1. In cPanel, open **WP Toolkit** (in **Applications**).
2. On the site's card, look at **Security** under **Status**. **Fix Security** means critical measures are missing; **Check Security** means some recommended measures are missing.
3. Click the message. In the panel that opens, select the measures you want, or the checkbox at the top of the list to select all, then click **Secure**.

The measures include blocking PHP in `wp-includes` and `wp-content/uploads`, blocking directory browsing, secure file permissions, renaming the `admin` user and turning off pingbacks. If a measure breaks something, select it and click **Revert**.

> **Note**
>
> On WP Squared or PanelAlpha, apply steps 1 to 4 in the WordPress dashboard and check the site's settings in your panel for its own security options.

## Step 6: Check file permissions and HTTPS

- Folders `755`, files `644`. Never `777`.
- Use HTTPS for the whole site, including the dashboard; see [turn on free SSL and force HTTPS](/guides/hosting-free-ssl-https).

## Step 7: Keep backups you can restore

We back up hosting accounts weekly and monthly at no extra cost. Before large updates, also download your own copy of the files and the database, and keep a few older copies: a hack is often noticed days later.

## Troubleshooting

**The site breaks after WP Toolkit applied a measure.** Open the security panel again, select the last measure and click **Revert**. Blocking PHP in `wp-content` can break plugins that run their own PHP files there.

**You are locked out after enabling two-factor sign-in.** Use the backup codes from the plugin. Without them, rename the plugin's folder in `wp-content/plugins` over SFTP or File Manager to turn it off, sign in, and set it up again.

**You find unknown administrators, files or redirects.** The site may already be compromised; see [clean a hacked website](/guides/clean-hacked-website).

## Next steps

- If something already went wrong: [fix WordPress errors](/guides/fix-wordpress-errors).
- Speed: [LiteSpeed Cache](/guides/wordpress-litespeed-cache).

## Frequently asked questions

### Do I need a security plugin?

Not for the basics in this guide. Updates, strong passwords, two-factor sign-in and fewer plugins prevent most attacks. Add a plugin only for features you really use, such as two-factor sign-in.

### Are automatic updates safe?

For most sites, yes: a missed security update is a bigger risk than a rare broken update. Keep backups so you can roll back, and test big shop or membership plugins first.

### Should I change the wp\_ table prefix?

WordPress says a different prefix can block some SQL injection attacks. On an existing site, changing it by hand can break the site; updates and strong passwords matter more.

### I think my site is already hacked. What now?

Do not just delete the files you notice. Follow our guide to cleaning a hacked website, and open a ticket so we can help you check the account.

---

Source: <https://hyperdc.com/guides/products/secure-wordpress-site>\
Updated: 2026-10-16