Most WordPress security problems come from neglect, not from the software itself: old versions, weak passwords, untrusted or unused plugins, loose file permissions and no backups. The official WordPress hardening guide's advice is practical: keep WordPress and plugins up to date, use strong generated passwords and two-step login, lock down file permissions, disable code editing in the dashboard, require HTTPS for administration, back up regularly and only install plugins and themes from trusted sources. No CMS is secure by default, so the question to ask of any of them, WordPress, Drupal or Joomla, is how well it is maintained.
Key takeaways
- WordPress's guide says older versions no longer get security updates, so "you should always keep up to date with the latest version of WordPress".
- Use generated, strong passwords, and enable two-step authentication as an extra layer.
- Lock down file permissions as much as possible and add
DISALLOW_FILE_EDITto wp-config.php to block code editing in the dashboard. - Require an HTTPS encrypted connection for administration.
- Back up regularly, including the database, and keep snapshots from several points in time.
- "Do not get plugins/themes from untrusted sources", keep them updated and delete those you do not use.
What causes most WordPress security problems?
Almost always, one of these:
| Problem | Why it matters | Fix |
|---|---|---|
| Outdated WordPress, plugin or theme | Old versions stop receiving security fixes | Update promptly; use automatic updates where suitable |
| Weak or reused passwords | Easy to guess or reuse after a leak | Generated passwords and two-step login |
| Untrusted or abandoned plugins | Code you did not vet runs on your site | Install only from trusted sources, remove unused ones |
| Loose file permissions | A compromised account can change code | Make core and plugin files writable only by your user account |
| Dashboard code editing | A stolen login can edit PHP files | Disable file editing |
| No backups | A hack or a bad update becomes a disaster | Regular, tested backups |
How do you harden a WordPress site?
Follow the WordPress hardening guide:
- Update everything. WordPress core, themes and plugins. Test major updates on a copy first if the site is critical.
- Use strong passwords. Generate them; avoid names, dictionary words and short or single-type passwords. Use a password manager.
- Turn on two-step authentication for every administrator.
- Lock down permissions. Make plugin and core files writable only by your user account, and restrict wp-config.php so only you and the web server can read it. You can move it one directory above the install.
- Disable file editing by adding
define( 'DISALLOW_FILE_EDIT', true );to wp-config.php. - Require HTTPS for administration.
- Back up regularly, including the database, keep several snapshots, store them away from the server and test a restore.
- Remove what you do not use, and give each person only the access they need.
How do you choose plugins and themes safely?
Treat every plugin as code with full access to your site. Before installing, check who maintains it, when it was last updated, whether it is still supported and whether you need it at all. The WordPress guide is direct: do not get plugins or themes from untrusted sources. Delete unused ones rather than deactivating them. Fewer plugins means fewer things to patch.
Is WordPress less secure than Drupal or Joomla?
Not by nature. All three are widely used, open-source content management systems that release updates, and all can be compromised if they are out of date or badly configured. Choose between them for your content needs and your team's skills, then maintain whichever you choose. Security comes from the habits above: updates, access control, trusted extensions, backups and monitoring. If you are weighing a different approach, such as a statically generated site with no public admin to attack, see Web development trends in 2026 and our website modernisation work.
What should you do if your site is hacked?
- Contain it. Put the site in maintenance mode or take it offline, and change all passwords, including hosting, database and administrator accounts.
- Restore from a clean backup taken before the problem, then update everything immediately.
- Find the entry point, such as an outdated plugin or a stolen password, and close it. Without that, it will happen again.
- Check for leftovers: unknown admin users, changed files and unexpected scheduled tasks.
- Tell the people affected if their data may have been exposed, and take advice if privacy law applies.
Where does AI come in?
AI tools can help review plugin code or summarise logs, but they also help attackers write convincing phishing messages, so two-step login and staff awareness matter more, not less. Do not paste credentials or customer data into AI tools.
FAQ
How often should I update WordPress?
As soon as updates are available, after testing on a copy if the site is critical. WordPress's guide says older versions no longer receive security updates.
Do I need a security plugin?
It can help with monitoring and login protection, but it does not replace updates, strong passwords, backups and careful plugin choice.
Is it safe to edit plugin files from the dashboard?
It is safer to turn that off. The guide recommends the DISALLOW_FILE_EDIT setting so a stolen login cannot change code.
How often should I back up?
Often enough that losing the newest changes would be acceptable; for a busy site, daily or more. Keep several snapshots and test the restore.
Is Drupal or Joomla more secure than WordPress?
None is secure by default. Each is as secure as its maintenance, so pick by fit and maintain it well.
Sources (1 link)
- WordPress Developer Resources, "Hardening WordPress": https://developer.wordpress.org/advanced-administration/security/hardening/
