Learn how to protect a WordPress website, update WordPress core,
themes and plugins, create secure login practices, and reduce
common website security risks.
Learning Objectives:
After completing this lesson, you will understand common
WordPress security threats, how to update your website safely,
and the best practices for protecting website data.
1. What Is WordPress Security?
WordPress security means protecting your website, its files,
database, user accounts, and visitors from unauthorized access
and harmful activity.
A secure WordPress website helps protect against:
Common Security Threats
Unauthorized login attempts
Malicious plugins or themes
SQL injection attacks
Cross-site scripting (XSS)
Malware and malicious file uploads
Outdated software vulnerabilities
Security Benefits
Protects website information
Reduces unauthorized access
Improves website reliability
Protects customer information
Reduces downtime and recovery costs
Helps maintain visitor trust
2. Why Are WordPress Updates Important?
WordPress regularly releases updates to improve security,
fix bugs, improve compatibility, and introduce features.
Themes and plugins also receive updates from their developers.
Types of WordPress Updates
WordPress Core Updates
These update the main WordPress software. They may
contain security fixes, bug fixes, and new features.
Themes Updates
Theme updates can fix security issues, improve
compatibility, and correct design problems.
Plugin Updates
Plugin updates can fix vulnerabilities, improve
functionality, and maintain compatibility with WordPress.
PHP Version Updates
Your hosting environment's PHP version should be supported
and compatible with your WordPress installation, themes,
and plugins.
Important:
Before major updates, back up your files and database. Test
important changes on a staging site when possible, and verify
that your themes and plugins are compatible.
3. How to Update WordPress
Follow these steps to update your WordPress website:
Update Procedure
Log in to the WordPress administration dashboard.
Open Dashboard > Updates.
Review available WordPress, theme, and plugin updates.
Create a recent backup before significant changes.
Apply updates, preferably in a staging environment first for major changes.
Check the website's pages, forms, login, and important features.
Review the site again after updates are completed.
4. Keep Themes and Plugins Updated
Outdated themes and plugins can contain security vulnerabilities.
Install extensions only from trusted sources and remove those
that are no longer required.
Recommended Practices
Install reputable themes and plugins.
Check update history and compatibility.
Remove unused plugins and themes.
Keep a backup before major changes.
Test important functions after updating.
Avoid These Mistakes
Using nulled or pirated plugins.
Installing unknown ZIP files.
Ignoring security updates.
Keeping abandoned extensions active.
Updating a business-critical site without a recovery plan.
5. Create a Strong Administrator Password
Weak passwords make it easier for attackers to gain access
to WordPress accounts. Use a unique, strong password for
every important account.
Password Security Tips
Use a long, unique password.
Use a password manager to store passwords securely.
Never share administrator passwords publicly.
Avoid reusing your hosting or email password.
Enable two-factor authentication where available.
Remove accounts that no longer need access.
6. Use Two-Factor Authentication
Two-factor authentication (2FA) adds another verification step
during login. Depending on the method, a user may need a
password and an authenticator-app code or another approved
verification factor.
Example:
Even if someone discovers your password, a properly configured
second authentication factor can make it harder for that person
to sign in to your account.
Choose a reputable 2FA solution and keep recovery codes in a
secure location. Make sure you have a recovery method before
enabling it for administrator accounts.
7. Limit User Permissions
WordPress provides different user roles. Assign each person
only the permissions needed to perform their work.
Role
Typical Permissions
Administrator
Manage site settings, users, themes, and plugins.
Editor
Manage and publish content, including other users' posts.
Author
Write, edit, and publish their own posts.
Contributor
Write and edit their own posts but cannot publish them.
Subscriber
Primarily manage their own profile and access permitted content.
Do not give every user the Administrator role. Grant only the
permissions required for that user's responsibilities.
8. Install a Security Plugin
Security plugins can provide additional protections and monitoring
tools. Available features vary by plugin and configuration.
Common Security Plugin Features
Login protection and rate limiting
Security scans for suspicious files
Firewall features
Security notifications and activity monitoring
Tools for reviewing certain security settings
To install a plugin:
Open Plugins > Add New Plugin.
Search for a reputable security plugin.
Review its developer, documentation, and compatibility.
Select Install Now.
Select Activate.
Configure the plugin according to your security requirements.
A security plugin does not replace updates, backups, secure
passwords, or correct server configuration.
9. Use HTTPS and an SSL/TLS Certificate
HTTPS encrypts data transmitted between the visitor's browser
and the website. It helps protect information while it travels
across the network.
HTTPS Benefits
Encrypts data transmitted over the connection.
Helps protect login and form submissions in transit.
Helps browsers verify the website's server identity.
Supports visitor trust and modern browser requirements.
Obtain and configure a valid TLS certificate through your hosting
provider or certificate authority. After configuring HTTPS,
verify that WordPress URLs, internal links, images, and other
resources load correctly over HTTPS.
HTTPS does not automatically make a website completely secure.
It protects data in transit but does not fix vulnerable plugins,
weak passwords, or compromised server files.
10. Protect WordPress Configuration and Files
WordPress stores database connection settings in
wp-config.php. This file contains sensitive
configuration information and must not be exposed publicly.
File Security Practices
Use correct file and directory permissions.
Keep database credentials private.
Do not commit production secrets to public repositories.
Keep server software and PHP updated.
Restrict access to configuration and backup files.
Disable unnecessary services and features.
Use hosting-level protections where available.
Avoid changing file permissions to overly permissive settings
such as allowing everyone to write to files. Use the permissions
recommended for your hosting environment.
11. Understand Common WordPress Attacks
Attack
Meaning
Prevention
Brute-force login
Repeated attempts to guess a password.
Strong passwords, 2FA, and login rate limiting.
SQL injection
Malicious input attempts to manipulate a database query.
Prepared queries, validation, and secure coding.
Cross-site scripting (XSS)
Malicious scripts are injected into content viewed by other users.
Context-appropriate output escaping and input handling.
Malware
Harmful code or files compromise the website.
Updates, trusted software, scanning, and incident response.
Privilege abuse
An account has excessive permissions or is misused.
Least-privilege access and regular account reviews.
12. Create Regular Backups
A backup is a copy of your website that can help you recover
after accidental deletion, a failed update, a security incident,
or a server problem.
What Should You Back Up?
WordPress database
Uploaded media files
Active themes and plugins
Custom code and configuration required for recovery
Other important website files
Store backups in a secure location separate from the production
website when possible. Protect access to backup files and test
restoration periodically. A backup that cannot be restored may
not help during an emergency.
13. Enable Automatic Updates Carefully
WordPress supports automatic updates for certain components.
Automatic updates can reduce the time a website remains exposed
to known vulnerabilities.
Before enabling an automatic-update strategy:
Make sure recent backups are available.
Understand which components will update automatically.
Check whether your hosting provider offers staging or recovery tools.
Monitor important pages and website functions after updates.
Review compatibility requirements for business-critical plugins.
Automatic updates are useful, but you should still monitor the
website and maintain a reliable recovery plan.
14. WordPress Security Checklist
Use this checklist when reviewing a WordPress website.
Website Security Checklist
15. Practical Assignment
Your Task
Log in to your WordPress dashboard.
Open Dashboard > Updates and review available updates.
Review your installed themes and plugins.
Identify plugins that are not required by your website.
Review administrator accounts and user roles.
Confirm that your website uses HTTPS.
Create a backup using your hosting provider or a trusted backup solution.
Prepare a security checklist for your own WordPress website.
16. Lesson Summary
WordPress security protects website files, users, and information.
Keep WordPress core, themes, plugins, and server software updated.
Use strong passwords and two-factor authentication.
Assign users only the permissions they require.
Use HTTPS and protect sensitive configuration files.
Maintain secure backups and test recovery procedures.
Security plugins provide additional tools but do not replace good security practices.