Updated October 2026. WordPress security problems almost always come through the same doors: weak or reused passwords, outdated plugins, and login pages open to automated guessing. Closing those doors stops most attacks on small business sites.
Who this guide is for: Owners of WordPress business sites, schools and online shops, especially those without an in-house developer.
Contents
Lock down logins
- Unique, long passwords for every admin, stored in a password manager.
- Two-factor authentication for all administrator accounts.
- Limit login attempts, and consider moving the login URL away from /wp-admin.
- Remove old admin accounts and give staff the lowest role they need.
Reduce the attack surface
- Disable XML-RPC if you do not use the mobile app or Jetpack.
- Delete unused plugins and themes, not just deactivate them.
- Disable file editing from the dashboard with
DISALLOW_FILE_EDIT. - Hide version numbers and directory listings.
Keep it updated
Update WordPress core, plugins and themes promptly, and only install plugins that are actively maintained. Nulled (pirated) premium plugins are a common source of malware.
Back up off the server
Daily database backups and weekly file backups, kept somewhere other than the website’s own server, and tested by actually restoring one.
Watch for trouble
Monitor uptime, check Search Console’s security issues report, and review new admin users regularly.
If you are hacked
- Take a copy of the site for investigation.
- Change every password and secret key.
- Restore from a clean backup or remove the malware.
- Find and close the entry point.
- Request a review in Search Console if Google flagged the site.
If personal data was exposed, check your obligations under Kenya’s Data Protection Act, 2019.
Key terms in WordPress security
- Two-factor authentication
- A second login step, such as a code from an app.
- Brute force attack
- Automated guessing of passwords.
- XML-RPC
- An older WordPress interface often targeted by attackers.
- Least privilege
- Giving each user only the access they need.
- Nulled plugin
- A pirated premium plugin, often bundled with malware.
- Malware scan
- A check of files and database for malicious code.
Questions to ask before you hire help with WordPress security
- How are logins protected?
- How often are updates applied?
- Where are backups stored and when were they last tested?
- Who monitors for problems?
- What is the plan if the site is hacked?
WordPress security: mistakes to avoid
- Sharing one admin login among staff.
- Leaving abandoned plugins installed.
- Keeping backups only on the same server.
- Ignoring update notices for weeks.
- Installing nulled premium plugins.
How to measure success
Track failed login attempts, days since last update, last successful restore test and any security warnings in Search Console, monthly.
What is different in Kenya
Kenya's Data Protection Act, 2019 places duties on organisations that hold personal data, including customer names, phone numbers and emails collected by website forms and shops. A hacked site can expose that data, so security is a compliance matter as well as a technical one. Schools, clinics and SACCOs handling sensitive data should take particular care.
Costs to plan for
Most hardening steps are free. Costs include a reputable security plugin or firewall, off-site backup storage and time for monthly updates, or a managed maintenance plan.
A worked example
Imagine a school website where three staff share one admin login. The developer gives each person their own account with the lowest role they need, turns on two-factor authentication for administrators, limits login attempts and moves the login URL. Unused plugins and themes are deleted, XML-RPC is disabled, and file editing from the dashboard is switched off. Daily backups go to separate cloud storage and a test restore is done. Uptime monitoring and monthly update checks are added to the calendar, and a one-page incident plan lists who to call and what to do first.
WordPress security: a 30-day starter plan
- Week 1: reset passwords, enable two-factor and remove unused accounts.
- Week 2: update everything and delete unused plugins and themes.
- Week 3: set up off-server backups and test a restore.
- Week 4: add monitoring and write the incident plan.
Summary
This guide to WordPress security covered: Lock down logins; Reduce the attack surface; Keep it updated; Back up off the server; Watch for trouble; If you are hacked. Work through them in order, measure as you go, and keep every fact tied to an official or first-hand source.
Sources
- WordPress: hardening guide (accessed October 2026)
- Office of the Data Protection Commissioner (accessed October 2026)
Need this done for you? See our security services.
WordPress security: frequently asked questions
Is WordPress secure?
WordPress core is well maintained. Most hacks come from weak passwords and outdated or pirated plugins.
Do I need a security plugin?
It helps, but logins, updates and backups matter more than any plugin.
Should I disable XML-RPC?
Yes, unless a tool you rely on needs it. It is a common target for password-guessing attacks.
How do I know if my WordPress site is hacked?
Common signs are unknown admin users, strange redirects, spam pages in Google and security warnings in Search Console.
Does hiding the login URL stop attacks?
It reduces automated attempts; strong passwords and two-factor do the real work.
Is free hosting security enough?
Hosting firewalls help, but logins, updates and backups on the site itself remain your responsibility.
How often should I change passwords?
Change them when staff leave or after any suspected breach; strong unique passwords and two-factor matter more than frequent changes.
Should I use a web application firewall?
A firewall at the host, CDN or plugin level blocks many automated attacks and is worth having.
Are free themes safe?
Themes from the official WordPress directory are reviewed; avoid unknown sources.
Related
Want help with this?
Tell us about your business in a few lines. We reply within one working day.
Prefer WhatsApp? +254 790 939 404 · We reply within one working day.