WordPress Security in 8 Checks Against Hackers and Malware

WordPress security means maintaining core, plugins, access and server so that known vulnerabilities are closed before attackers find them. WordPress runs about 40 percent of all websites (W3Techs, as of September 2026), which makes it a favourite target for automated attacks. Most successful hacks exploit vulnerabilities that were patched long ago.

Is WordPress Secure?

The WordPress core is well protected. A dedicated security team looks after it, and since version 3.7 WordPress installs minor security updates automatically. The risk lies in the extensions. Of the 11,334 new vulnerabilities reported in the WordPress ecosystem in 2025, 91 percent were in plugins and 9 percent in themes. The core accounted for six, all of them low priority (Patchstack, State of WordPress Security in 2026).

So Why Does WordPress Have a Reputation for Being Insecure?

Because many installations are no longer maintained after launch. According to Patchstack, 46 percent of the vulnerabilities reported in 2025 had no update available when they were disclosed. For particularly attractive vulnerabilities, mass attacks start a median of five hours after disclosure. If you only update every few months, your website stays open for that long.

1. Install Updates Promptly

Outdated plugins are the number one way in. Known vulnerabilities are publicly documented, and bots search specifically for websites where they are still open. Check core, theme and plugins every week and install security-critical patches immediately, always with a backup first.

Since WordPress 5.5 you can enable automatic updates for individual plugins directly in the plugin overview. That is worthwhile for non-critical plugins. Updates for shop, booking or form plugins are better tested on a staging copy first.

2. Secure the Login

• No username “admin”. It sits at the top of every attack list.
• Strong, unique passwords from a password manager.
• Two-factor authentication for all administrators.
• Limit login attempts, otherwise brute-force attacks carry on indefinitely.

3. Clean Up User Permissions

Delete the accounts of former employees, test accounts and access for service providers who no longer work for you. Anyone who only writes posts gets the “Author” role instead of administrator rights. That limits the damage if an account falls into the wrong hands.

4. Clear Out Plugins and Themes

Because 91 percent of new vulnerabilities are in plugins, every installed plugin increases the attack surface. This also applies to deactivated plugins, because their files remain on the server and can often be called directly. Delete everything you do not use.

For the remaining plugins, check when the last update was released. A plugin that has not been updated for more than a year is often no longer maintained by its developer. Replace it with a maintained alternative. Never install cracked premium versions from unofficial sources (“nulled” plugins and themes). They often contain malicious code from the moment you download them.

5. Backups That Work in an Emergency

Set up daily automatic backups and store them externally, not on the server that could be hacked. Restore a backup as a test once a quarter. Only then do you know that recovery will work when it counts.

6. Malware Scan and File Integrity

Check the installation monthly for modified files and malicious code. Between scans, watch for warning signs such as unknown admin accounts, sudden redirects, spam pages in the Google index or warnings in the browser.

7. Harden the WordPress Configuration

You set these options once and only check them again after a migration or relaunch.

• Disable the file editor. In wp-config.php, set the constant DISALLOW_FILE_EDIT to true. This locks the theme and plugin editor in the dashboard, so anyone who captures an admin account can no longer inject code there.
• Disable XML-RPC if no app and no service such as Jetpack uses it. Many brute-force attempts run through this interface.
• Hide error messages. On the live website, WP_DEBUG is set to false so that visitors do not see file paths and version numbers.
• Check file permissions. Folders 755, files 644, and wp-config.php even more restrictive at 440 or 400, depending on the host.

How to Find Malicious Code in WordPress

Unfamiliar redirects, unknown administrators or spam pages on Google point to a hack. Work through these steps in order.

1. Check Search Console. In the “Security issues” report in Google Search Console, Google flags hacked content and malware. A search for site:yourdomain.com shows spam pages that did not come from you.
2. Scan from the outside. An external scanner such as Sucuri SiteCheck checks the public pages for known malware and blocklist entries.
3. Compare files with the originals. With WP-CLI, wp core verify-checksums checks all core files against the official checksums, and wp plugin verify-checksums --all does the same for plugins from the WordPress directory. Without the command line, a security plugin such as Wordfence handles this comparison.
4. Search for suspicious code. PHP files have no place in the wp-content/uploads folder. Obfuscated code with eval( or base64_decode( in theme and plugin files is a strong indication, but not proof.
5. Check users and the database. Delete unknown administrators and remove injected scripts from posts, widgets and the options table.
6. Clean up and close the gap. Renew all passwords and the security keys (salts) in wp-config.php. Restore a clean backup or reinstall core and plugins. Then close the vulnerability the attack came through, otherwise the website will be infected again within a short time.

The 8 Checks as a Checklist

Frequently Asked Questions About WordPress Security