Imagine waking up in the morning, checking your site, and it’s an absolute mess. Your browser flashes a malware warning, your homepage is advertising questionable hair-growth pills, and your website logo has been replaced by a dancing raccoon.
Meanwhile, your inbox is exploding with emails from customers asking if the “crypto investment opportunity” sent by your “company representative” is real or not.
This might sound exaggerated, but the threats behind it are very real. If you don’t take security seriously, any one of them could hit your website sooner rather than later. Here’s how to keep your website secure against common threats.
What is website security?
Website security refers to the steps you take to protect your website from cyber threats and unauthorized access. It involves every level of website architecture, from the server and website files to login credentials and user privacy.
Strong website security builds trust with visitors, keeps your site online, and protects you from potential legal action and other negative outcomes.
What are some common website security threats?
The first step in protecting your site is understanding what you are trying to prevent. Threats include:
- Password breaches: This often happens through brute force, where hackers automatically try out username and password combinations until they gain access to your site.
- Defacement: This is the online form of vandalism. An attacker changes the appearance of your website, often with a message that you’ve been hacked.
- Ransomware: This blocks access to your website and encrypts your files until you pay the attacker.
- Data breaches: Hackers steal confidential information saved on your site to sell on the black market or use for their own purposes.
- Malware infection: Malicious software is injected into your site to spread to visitors, for example, to hijack their computers.
- Denial of service attacks: DoS or DDoS attacks aim to overload your server with traffic or large amounts of data in order to make your website slow or completely inaccessible.
- Cross-site scripting (XSS): Malicious scripts are inserted into web pages so attackers can harvest login credentials and other information from user browsers.
- SQL injections: Code to run database commands and change, delete, or steal data is injected into a site. This may include creating a new user with administrator rights to your website.
- Spam: Filling your website with unwanted ads and malicious links.
- Phishing: Fake login or input forms designed to trick users into entering personal information.
- Botnet recruitment: Hijacking your site and server resources as part of a larger network of compromised sites to carry out attacks.
The scope and variety of online threats make security an issue even for basic websites.
Why does this matter?
The possible outcomes of having your website compromised include:
- Loss of revenue: Downtime, ransom demands, or an otherwise non-functional website can immediately impact your income, especially for e-commerce websites. Plus, recovery usually comes with a price tag.
- Reputation damage: A website that has been defaced, contains spam links, or fails to protect customer data erodes visitor trust and can permanently damage your brand.
- SEO damage: Search engines may lose trust in your site as well, blocking it and tanking your search rankings and traffic in the process.
- Legal problems and fines: Exposing sensitive user data may violate data protection laws like GDPR or HIPAA, leading to potentially hefty fines. People whose personal information was stolen may also sue you.
Lack of website security can greatly damage your business and income — sometimes to the point of no return. And don’t think your site being small means you’re safe. Most hacks are automated, aimed at gaining access over stealing data, and a matter of opportunity, not targeted action.
How to secure your website
Once you understand the risks, the next step is to protect your site. Website security is all about layering protections, not single fixes. Secure your site with these simple steps:
1. Change default CMS settings
Many attacks against WordPress target its default configuration. Therefore, an easy step to make your website safer is to change them. For example:
- Avoid using the username “admin” during setup.
- Use a unique database table prefix instead of the default “wp”.
- Customize your login URL to reduce automated login attempts.
2. Use a secure hosting provider
Your hosting provider is your website’s first line of defense. For that reason, you want to pick one that prioritizes security.
Choose the right type of web hosting for your purpose and skill level. For example, shared hosting runs a greater risk of cross-contamination from other sites on the same server that get hacked. With isolated site infrastructure such as that on WordPress.com Business and Commerce plans, this isn’t an issue.
In traditional hosting, most of managing website security is your responsibility; your hosting provider only takes care of the server. A managed WordPress hosting provider, on the other hand, is much more involved in securing your website. For example, when you host your site on WordPress.com, you benefit from:
Plus, if you host your website on WordPress.com and it gets hacked, we will clean it up for free.
3. Use SSL/HTTPS
HTTPS encrypts the data transferred between your website and visitors’ browsers. This is an effective way to protect sensitive information against cross-site scripting (XSS), man-in-the-middle, or similar attacks. It also displays as a secure padlock icon in the browser and is a sign of trust for your audience.
To enable HTTPS encryption, you need an SSL certificate, which is usually easiest to obtain from your hosting provider. For example, SSL is included by default on all WordPress.com sites, with no setup needed.
4. Configure file permissions correctly
File permissions define who can modify which files on your server. They help prevent unauthorized users or scripts from modifying core files. You can modify file permissions with SFTP/SSH.
On WordPress.com, permissions are set to the above settings by default and should only be changed if it’s absolutely necessary and you know what you’re doing.
On WordPress, files should typically be set to permission level 644 and directories to 755. This balances functionality and security. Avoid setting anything to 777, which allows full read, write, and execute access.
5. Set up security headers
Security headers add an extra layer of protection by controlling how browsers handle your site’s content. They can help prevent vulnerabilities like cross-site scripting and clickjacking, and are an important part of every website.
This topic is very technical, so it’s best to read up on security headers in depth. You can find out if your site is already using them with a security headers scanner. If they’re missing, options to enable them include:
6. Implement a web application firewall
A web application firewall (WAF) has the ability to filter and block malicious traffic before it reaches your website. This helps defend against common threats like SQL injections and brute force attacks.
You can get a firewall through your hosting provider, plugins, or external providers. On WordPress.com, Business and Commerce plans include a built-in, managed firewall.
7. Use a content delivery network
A content delivery network (CDN) distributes your website’s content across multiple servers worldwide.
This reduces server load and is often a tool used to improve performance. It helps mitigate DDoS attacks by adding a layer between attackers and your origin server that can absorb some of the excess traffic. Cloudflare is a popular option.
WordPress.com includes CDN functionality powered by more than 28 data centers across six continents.
8. Force strong usernames and passwords
Weak login credentials are one of the most common ways hackers gain access to websites.
Here are some best practices to prevent that from happening:
- Avoid predictable usernames like “admin” or “user.”
- Use strong passwords with a mix of letters, numbers, and symbols for all entry points to your website, including your FTP, database, and hosting account. You can generate them with the help of a password generator.
- Require the same for all users with access to your site, if necessary with a plugin like Password Policy Manager.
- Consider using separate accounts for site administration and content creation, so as not to display the admin username on your site.
- Be sure to balance safety and usability.
To keep your login pages safe, WordPress.com offers out-of-the-box brute force protection and single sign-on (SSO).
9. Set up multi-factor authentication
Multi-factor authentication (MFA) adds an extra layer of protection to site logins. It requires a second verification step, such as inputting a code from an app or text message. This makes it much harder for attackers to log in, even with stolen credentials.
You can add this functionality to your WordPress site using MFA plugins. WordPress.com supports two-step authentication for all users by default.
10. Apply sensible user roles and permissions
WordPress offers several user roles with clearly defined permissions. These let you control who has access to your site and what they can do on it. Here is the full list:
- Administrator: Full access to all site features and settings.
- Editor: Can manage all content, including posts, pages, comments, categories, tags, and media.
- Author: Can create, edit, upload media to, and publish their own posts.
- Contributor: Can write and edit their own posts but cannot publish or upload media.
- Viewer: Can read and comment on private site content.
- Subscriber: Follows your site and receives updates.
It’s a good idea to use the principle of least privilege when assigning roles, which restricts user access to only the functions needed for each job. This reduces the risk of someone breaking something by accident and provides extra protection if an account gets hacked.
You can upgrade permissions temporarily if needed, but be sure to review and update user roles regularly, especially after team changes.
11. Install a security plugin
Security plugins provide extra safety with features like malware scanning, firewalls, and security headers.
For self-hosted WordPress sites, security plugins cover gaps not managed by your hosting provider. Popular choices are:
Plugin-enabled sites on WordPress.com don’t require a security plugin, because they come with Jetpack and many other protections built in. Installing a separate security plugin on these sites would likely lead to conflicts.
12. Use trustworthy extensions
Plugins and themes allow you to use WordPress for any purpose and use case, from blogs to personal websites to one-page sites.
At the same time, they can also be a security risk. Poorly coded or abandoned extensions can introduce serious vulnerabilities. In addition, plugins from untrustworthy sources can contain malware, back doors and other unpleasant surprises.
To avoid this, only install plugins and themes from reputable sources, like official WordPress directories. Everything you find there goes through a thorough vetting process before it can be installed on websites. Read reviews, check the update history, and confirm compatibility with your WordPress version before installing.
13. Delete unused plugins and themes
Even inactive plugins and themes can create security risks if they’re outdated or vulnerable. You should deactivate and fully delete anything you’re not actively using.
You should also regularly audit your installed extensions for what you can get rid of. Fewer extensions mean fewer potential points of attack.
14. Keep your website up to date
Updates to WordPress and its plugins and themes often include patches for known security vulnerabilities. For that reason, it’s a good idea to regularly apply them on your site.
As a managed hosting provider, WordPress.com automatically handles core updates and provides tools to update plugins and themes either automatically or manually. You can test updates on a staging site before publishing updates.
15. Set up automatic backups
Backups are one of the most central tools for website security. If you have a recent working version of your site saved somewhere safe, you can restore it to mitigate problems.
For that reason, you should regularly back up both your site files and database, preferably with an automated solution. Be sure to store backups in a secure, off-site location like cloud storage or a separate server.
On WordPress.com, real-time backups and one-click restores are included in the Business and Commerce plans.
16. Limit personal and sensitive data saved on your site
You can’t lose what you don’t have. If your website gets hacked, attackers can only gain access to data that’s stored there. For that reason, be sure to only collect and store the information you need from your users, and follow data protection laws like GDPR when handling personal information.
17. Use an anti-spam plugin
Comment spam is an inconvenience every website owner has to live with. But if you’re not adept at recognizing it, you might inadvertently post links to malicious websites or software on your site, creating legal and SEO risks.
Akismet is an anti-spam plugin that automatically filters out the majority of spam submissions using machine learning and AI. It is included on all WordPress.com plans with no extra setup.
18. Log website activity
Activity logs track user actions and changes made on your site. They make it easier to trace what happened in the event of a breach or other problems.
There are many plugin options to add them to your site and WordPress.com also offers built-in activity logs.
19. Stay informed on current threats
Security threats constantly evolve, so staying informed is essential in order to respond and strengthen your defenses quickly.
Two good resources for the latest vulnerabilities and best practices are:
In addition, sign up for security newsletters or alerts from your hosting provider or plugin vendors.
20. Educate and train all website users
Your website security is only as strong as your least-informed user. For that reason, make sure all team members understand security best practices. Train them to recognize phishing attempts and suspicious activity, use strong passwords and MFA, and to not share accounts and reuse credentials.
Keep in mind that website safety includes device security, so be sure to implement malware scans and other security measures on your team’s computers.
21. Scan your site regularly
Scanning your website helps catch vulnerabilities, malware, or suspicious changes early. It lets you know if there is a problem in real-time and prevents threats from going undetected on your site.
You can use automated tools or services to schedule scans daily or weekly. OWASP has a detailed list of options.
On WordPress.com, Jetpack Scan checks every site daily for dangerous plugins, themes, malware, and other vulnerabilities. On higher-tier plans, you also get access to a history of threats identified on your site.
22. Have a recovery plan
No matter how diligent you are, the risk to your website is never zero. If the worst-case scenario happens, advanced preparation will help you stay calm and mitigate the potential damage.
Put together a recovery plan with information such as:
- Step-by-step instructions for different scenarios
- Who to contact in case of emergency and how
- How to let customers know what’s happening
- Legal requirements for reporting security breaches
Practicing your recovery process ahead of time can save hours or even days during a real incident. And remember, with a WordPress.com plan, site recovery is free.
An ounce of prevention is worth a pound of cure
Investing in security measures for your website is essential for protecting your content, users, and reputation. Threats are real, common, and often automated, and everyone is a target. Fortunately, many of the most effective protections are simple to implement. If you use a high-quality managed hosting provider like WordPress.com, you’re already ahead of the game.
Just keep in mind that security is not a one-time task, but an ongoing process. Regularly review your systems and processes to continue staying safe. If a breach happens, don’t panic, just recover, analyze, and make sure it can’t happen again.
