Protect a WordPress site by keeping its core software, themes, and plugins updated; limiting and protecting administrator access; maintaining separate, restorable backups of both files and the database; and monitoring activity. If you suspect a compromise, document what happened, contact your host, preserve a snapshot, secure credentials, and clean the site based on evidence. No single security plugin or backup copy is a complete defense.
What protects a WordPress site from malware?
Use several safeguards together rather than relying on one plugin or setting. WordPress’s official security guidance calls keeping WordPress and all installed plugins and themes up to date the most important security measure.
As an Amazon Associate I earn from qualifying purchases.
- Update the software: install supported WordPress releases and keep themes and plugins current.
- Reduce what can be attacked: remove extensions and themes you do not use, and choose software from trusted sources that is actively maintained.
- Protect access: use long, unique passwords, enable multifactor authentication where available, and give accounts only the access their users need.
- Keep recoverable backups: save both the site files and database, store copies separately from the production site, and test that they can be restored.
- Monitor activity: retain logs and know where to find them so you can review timing, IP addresses, and actions if an incident occurs.
WordPress versions older than the current supported major release do not receive security updates on a guaranteed schedule. The official supported versions page identifies the latest major release as the only officially supported version; check it when planning upgrades rather than assuming an older branch will continue receiving fixes.
Recommended Free Tools
How should you handle updates and extensions?
Keep core, plugins, and themes current
WordPress has supported automatic core updates since version 3.7; plugin and theme auto-updates were introduced in WordPress 5.5. Automatic updates can reduce delays, but they are not a substitute for checking that updates completed and the site still works. Have a rollback or restore option before enabling automatic plugin or theme updates.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Scheduled updates rely on WordPress Cron, and a host or plugin can disable the controls. If expected updates are not running, check Dashboard → Tools → Site Health and ask your host whether scheduled updates are restricted. The WordPress plugin and theme auto-updates documentation explains the feature and its controls.
Choose and remove extensions deliberately
Install plugins and themes from sources you trust, and favor projects that continue to receive updates. Remove inactive extensions you do not need; leaving them installed adds software to maintain and review. Be especially cautious with extensions that request write access or permit arbitrary code execution: use them only when there is a clear, controlled need.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Which security layers make sense?
Firewalls can filter traffic at different points: inside WordPress through a plugin, at the web server, or through a reverse proxy before traffic reaches the host. These layers differ in who maintains the rules, what traffic they can see, and how they affect site configuration. WordPress describes these options in its hardening guidance; none should be treated as a complete guarantee against compromise.
- WordPress-level filtering: a plugin operates within the application and may be easier to configure, but it is only one layer and can be affected if the application itself is compromised.
- Server-level filtering: a web application firewall such as ModSecurity is configured at the server. Changes may require host or server-administrator involvement.
- Reverse-proxy filtering: an intermediary filters requests before they reach the hosting server. Confirm how it handles your site’s traffic and what logs or monitoring it provides.
Restricting access to /wp-admin/ may sound useful, but blanket restrictions can break legitimate functions such as admin-ajax.php. Check compatibility and test changes before deploying them. When evaluating a security layer or service, establish where filtering occurs, who updates its rules, whether it includes monitoring or human cleanup, and what evidence it retains.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
How often should you back up WordPress?
Back up both the WordPress files and its database. A copy of the web directory alone normally does not include the separate database, where site content and other important information are stored. Keep the files and database together as a coordinated backup set.
WordPress’s general backup guidance suggests weekly backups for smaller sites and daily backups for high-activity sites. These are starting points, not a universal schedule: choose a frequency based on how much recent content or transaction data you can afford to lose.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
- Keep three to five recent backup sets in different locations, such as host storage, cloud storage, and a local computer.
- Periodically make a manual backup to check that automated backups are actually working.
- Before software updates, confirm that you can roll back or restore.
- Encrypt backups and use read-only or otherwise protected storage when feasible.
- Test restoration periodically; a backup that has never been restored is not a verified recovery plan.
An external drive can provide an additional local copy of the site files and a database export. It is only one storage location, however. Keep other separated copies and verify that the backup set can be restored; a drive attached to or stored beside the production system is not, by itself, protection from malware or ransomware.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesWhat should you do if your WordPress site may be hacked?
Start by documenting observations and timing before making changes, where practical. WordPress’s hacked-site guidance identifies documentation as the first actionable step after a compromise. A site outage can resemble an attack, so consult the hosting provider before assuming the cause.
- Record what you see. Note symptoms, when they began (including the time zone), recent site changes, and relevant hosting details. Preserve relevant evidence before changing the environment when practical.
- Check the indicators. Look for unauthorized users or site changes, browser or antivirus warnings, search-engine blacklisting, malware-distribution flags, or a host suspension. Ask the host whether an outage or server issue could explain the symptoms.
- Scan the site and the administrator’s computer separately. WordPress distinguishes application-level scanners from remote crawlers; use appropriate checks from more than one vantage point. Also scan the computer used to administer the site. A compromised computer can expose FTP or admin credentials, and a clean computer scan does not prove the web server is clean.
- Contact the hosting provider. This is especially important on shared hosting, where other sites or the server may also be involved. Ask what server-side findings are available and what backup or restore options exist.
- Secure access and preserve a snapshot. Reset passwords for administrators and relevant accounts, and rotate credentials for every access point: WordPress administration, hosting panels, FTP or SFTP, and database access. Change WordPress secret keys to invalidate active sessions. Capture a site snapshot before cleanup for reference and forensic review.
- Clean based on evidence and your capability. Replacing WordPress core directories is different from reviewing
wp-content, which contains themes and plugins. Avoid blind deletion: it can remove needed data without eliminating persistent access. If the scope is unclear or the site handles important customer data, involve a qualified incident-response professional. - Update and investigate after cleanup. Update WordPress and its extensions, change passwords again, and investigate how access was gained. Review logs and host findings, and confirm that relevant warnings or flags have cleared.
The appropriate cleanup depends on the symptoms and the owner’s technical ability; this is a practical outline, not a universal forensic procedure. Keep evidence and coordinate with the host when deciding whether to restore a backup or clean the existing installation.
What changes if ransomware is suspected?
Treat suspected ransomware as a serious site compromise and recovery problem. The official WordPress sources cited here do not provide a WordPress-specific ransomware procedure for ransom negotiations, decryption, legal or reporting duties, or breach notifications. Do not assume that restoring a backup alone resolves the incident: the entry point or persistence mechanism may remain. Contact the host and involve a qualified incident-response professional when business-critical systems or sensitive data may be affected.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
