How to Secure Your WordPress Website

Overview

WordPress is one of the most widely used website platforms on the internet, which also makes it a common target for automated attacks.

Keeping your WordPress website secure doesn't have to be complicated. A few basic practices can significantly reduce the chances of common problems.

Security is a shared responsibility. Have Freedom Hosting works to maintain the hosting environment, while you are responsible for the WordPress installation, plugins, themes, accounts, and content you manage.

Keep WordPress Updated

One of the most important things you can do is keep WordPress up to date.

Updates can contain:

• Security fixes

• Bug fixes

• Compatibility improvements

• Performance improvements

• New features

Regularly check:

WordPress → Dashboard → Updates

Don't ignore security-related updates simply because your website appears to be working normally.

Keep Plugins and Themes Updated

Outdated plugins and themes can introduce security vulnerabilities.

Regularly review:

Dashboard → Updates

and update:

• WordPress

• Plugins

• Themes

Remove plugins and themes you no longer use instead of leaving them installed indefinitely.

Use Strong Passwords

Every WordPress administrator account should have a strong, unique password.

Avoid passwords based on:

• Your name

• Your business name

• Your domain

• Birthdays

• Common phrases

• Simple patterns

• Passwords used on other websites

Never reuse your WordPress administrator password for your:

• Customer Portal

• cPanel

• Email

• Domain registrar

• Other online services

A compromised password on another website should not automatically give someone access to your WordPress website.

Protect Administrator Accounts

Only give administrator privileges to people who actually need them.

If someone only needs to write blog posts, they generally don't need full administrator access.

Use the lowest appropriate WordPress role for each user.

Periodically review:

WordPress → Users → All Users

and remove accounts that are no longer needed.

Don't Share Administrator Accounts

Avoid having several people use one shared administrator account.

Instead, create individual WordPress accounts for people who need access.

This makes it easier to:

• Remove access when someone leaves.

• Identify who performed an action.

• Change one person's access without affecting everyone else.

• Limit permissions appropriately.

Enable Two-Factor Authentication When Available

Two-factor authentication adds another layer of protection beyond a password.

If your WordPress security solution or hosting environment supports two-factor authentication, consider enabling it for administrator accounts.

This can help protect an account even if its password is compromised.

Use Trusted Plugins and Themes

Only install plugins and themes from legitimate sources.

Avoid:

• Pirated plugins

• "Nulled" themes

• Modified commercial software

• Unknown download sites

• Unmaintained plugins

• Suspicious security tools

A plugin that promises premium functionality for free may contain malicious code or hidden access mechanisms.

If you need a commercial plugin or theme, obtain it from the developer or an established marketplace.

Remove Unused Plugins and Themes

An unused plugin doesn't provide any benefit if you aren't using its functionality.

If you no longer need one:

1. Deactivate it.

2. Verify that your website still works.

3. Delete it.

Do the same for unused themes when appropriate.

Keeping your installation lean makes it easier to maintain and reduces the amount of software that needs to be kept updated.

Keep PHP Up to Date

WordPress runs using PHP, so the PHP version assigned to your website matters.

You can manage PHP versions through:

cPanel → Software → MultiPHP Manager

Your WordPress installation, plugins, and themes must be compatible with the PHP version you use.

Don't automatically switch to the newest available version without checking compatibility first.

At the same time, avoid leaving a website on an obsolete PHP version indefinitely.

Use HTTPS

Your website should use HTTPS whenever possible.

HTTPS protects information exchanged between your visitors and your website and helps prevent certain types of interception or manipulation.

Have Freedom Hosting offers free SSL certificates through Let's Encrypt, as well as paid SSL options for customers who have specific requirements.

After SSL is configured, your website should normally be accessible through:

https://yourdomain.com

Keep Your Computer Secure

Your website can be compromised through more than just the web server.

If malware steals your WordPress password from your computer, an attacker may be able to log into your website legitimately.

Keep the computers and devices you use to manage your website secure by:

• Installing operating-system updates.

• Keeping your browser updated.

• Using reputable security software.

• Avoiding suspicious downloads.

• Being cautious with email attachments.

• Not entering passwords into unfamiliar websites.

Be Careful With WordPress Login Pages

Your WordPress administrator login is commonly located at:

https://yourdomain.com/wp-admin

Don't enter your credentials into a website unless you've verified that you're actually visiting your own domain.

Be particularly careful with links received through unexpected emails or messages.

Protect Your Hosting Account Too

WordPress security is only one part of the picture.

Your website also depends on your:

• Have Freedom Hosting Customer Portal

• cPanel account

• Domain registrar

• Email accounts

• DNS configuration

If an attacker gains access to your hosting account, they may be able to affect your website even if WordPress itself is secure.

Use strong, unique passwords throughout your hosting environment.

Protect Your Domain Account

Your domain registrar controls your domain's registration and nameserver settings.

Someone who gains access to your registrar account may be able to redirect your domain to another service or otherwise interfere with your website.

Use strong authentication and enable additional security features offered by your registrar whenever available.

Be Careful With DNS Changes

DNS determines where services such as your website and email are directed.

If your DNS is managed through cPanel, records can generally be reviewed through:

cPanel → Domains → Zone Editor

Don't make DNS changes simply because a website or email problem occurs.

An incorrect DNS record can break an otherwise functioning website or email service.

Keep Regular Backups

Backups are one of the most important parts of website security.

Even with good security practices, websites can still experience:

• Accidental changes

• Plugin problems

• Failed updates

• File corruption

• Account compromise

• Other unexpected issues

A backup gives you a recovery option when something goes wrong.

Don't assume that having a backup means the backup is useful. Periodically verify that your backup process is actually producing usable copies.

Don't Rely on Security Plugins Alone

Security plugins can provide useful features, but installing a security plugin doesn't automatically make a website secure.

A secure WordPress installation still requires:

• Updates

• Strong passwords

• Account management

• Backups

• Trusted software

• Secure hosting practices

• Regular maintenance

Think of security tools as another layer rather than a replacement for good practices.

Watch for Suspicious Activity

Pay attention to unexpected changes such as:

• New WordPress administrator accounts.

• Password-reset emails you didn't request.

• Unexpected plugins or themes.

• Website pages you didn't create.

• Unexpected redirects.

• Strange advertisements appearing on your website.

• Unknown files.

• Changes to your website's content.

• Unexpected emails being sent from your account.

If something doesn't look right, investigate it rather than ignoring it.

Review WordPress Users

Periodically review:

WordPress → Users → All Users

Look for:

• Unknown accounts

• Former employees or contractors

• Unnecessary administrators

• Accounts with unexpected permissions

Remove accounts that are no longer needed.

Be Careful With File Permissions

WordPress files need appropriate permissions to function, but overly permissive permissions can create unnecessary security risks.

You can review file permissions through:

cPanel → Files → File Manager

Common WordPress permissions are often:

• Files: 644

• Directories: 755

These are general examples, not a requirement that every file on every website use exactly those permissions.

Never blindly change everything to 777.

Protect Configuration Files

WordPress contains configuration information that should not be exposed publicly.

One important file is:

wp-config.php

It contains information WordPress uses to connect to its database.

Don't publish, email, or otherwise expose the contents of this file.

If you've accidentally exposed sensitive configuration information, treat the affected credentials as compromised and take appropriate corrective action.

Don't Put Sensitive Information in Website Files

Avoid storing sensitive information in publicly accessible directories unless the application specifically requires it and the files are appropriately protected.

Remember that files placed inside a website's document root may potentially be accessible through the web.

If you're unsure whether a file should be publicly accessible, don't upload it until you've determined how it should be protected.

Be Careful With Third-Party Access

If a developer, designer, or contractor needs access to your website, don't give them your personal administrator account if you can avoid it.

Create an individual account for them with only the permissions they need.

When their work is complete:

1. Review their access.

2. Remove or disable the account if it is no longer needed.

3. Change shared credentials if any were used.

4. Review other access they may have been given.

The same principle applies to cPanel and FTP access.

Use Separate FTP Accounts When Appropriate

If someone needs to upload or modify website files, consider creating a dedicated FTP account rather than giving them your cPanel credentials.

You can manage FTP accounts through:

cPanel → Files → FTP Accounts

A dedicated FTP account can be restricted to the directory the person actually needs.

This limits the potential impact of a compromised or misused credential.

Be Careful With WordPress Plugins That Request High Privileges

Some plugins legitimately need significant access to your website.

Before installing one, consider:

• Who developed it?

• Is it actively maintained?

• Does it have a good reputation?

• Does it actually need the permissions it requests?

• Is it from a trusted source?

• Are updates available?

Don't install software simply because it promises an attractive feature.

Keep an Eye on Website Changes

Regularly visit your website.

You're more likely to notice a problem quickly if you know what your website normally looks like.

Look for:

• Unexpected pages

• Redirects

• Pop-ups

• Unknown advertisements

• Modified content

• Broken functionality

• Browser security warnings

Early detection can make recovery much easier.

If You Think Your WordPress Website Has Been Hacked

If you suspect your website has been compromised:

1. Don't ignore the problem.

2. Avoid making unnecessary changes.

3. Change affected passwords from a known-clean device.

4. Check WordPress administrator accounts.

5. Check for unfamiliar plugins and themes.

6. Check for unexpected website files.

7. Review recent changes.

8. Check your hosting account for suspicious activity.

9. Preserve useful error messages and information.

10. Contact Have Freedom Hosting Support.

If sensitive information may have been exposed, consider the appropriate security and reporting steps for your situation.

A compromised website may require a more thorough cleanup or restoration from a known-good backup.

What Have Freedom Hosting Can Help With

Have Freedom Hosting Support can assist with hosting-related concerns such as:

• Hosting account access

• cPanel access

• Website files

• Hosting resources

• DNS configuration

• SSL and HTTPS

• Server-side errors

• Hosting service availability

However, individual WordPress plugins, themes, and custom website code are generally developed and supported by their respective developers.

If you're unsure whether a problem is caused by WordPress or the hosting environment, provide the details when opening a support ticket and we'll help determine where the problem appears to be occurring.

Security Checklist

For a basic WordPress security routine:

• Keep WordPress updated.

• Keep plugins updated.

• Keep themes updated.

• Remove unused plugins and themes.

• Use strong, unique passwords.

• Limit administrator accounts.

• Use individual accounts instead of shared logins.

• Enable two-factor authentication where available.

• Use HTTPS.

• Keep PHP reasonably current.

• Maintain regular backups.

• Use trusted plugins and themes.

• Keep your computer secure.

• Review WordPress users periodically.

• Monitor your website for unexpected changes.

• Protect your hosting and domain accounts.

Need Help?

No website can be guaranteed to be completely immune to attack, but good maintenance practices can greatly reduce common risks.

Keep your WordPress installation and its components updated, use strong credentials, maintain backups, and investigate anything unusual.

If you believe your WordPress website or Have Freedom Hosting account has been compromised, contact Have Freedom Hosting Support as soon as possible and provide as much information as you can.

Never send passwords, authentication codes, or other sensitive credentials in a support ticket.