WordPress compromises follow a boring script: an outdated plugin with a known vulnerability, an admin account named admin with a guessable password, or a nulled theme carrying a backdoor as its price. Attackers run automated scans for exactly these, which means defense is mostly about not being the easy target.
Close the front door
- Enforce strong passwords and two-factor authentication for every administrator, no exceptions for the founder.
- Rate-limit login attempts, and rename or protect wp-login against the bots hammering it around the clock.
- Disable XML-RPC unless something genuinely uses it; it is a brute-force amplifier in the default install.
- Apply least privilege: authors do not need admin, and the agency contractor from 2022 does not need an account at all.
Shrink the attack surface
Every plugin is code you invited in, so fewer, better-maintained plugins beat a drawer of abandoned ones; check the last-updated date and support threads before installing anything. Never install nulled premium plugins, which are malware with a coupon. Keep core, themes, and plugins updated on a schedule, and enable auto-updates for security releases. At the server level: correct file permissions, no file editing from the dashboard (DISALLOW_FILE_EDIT), and PHP execution blocked in the uploads directory.
Assume breach, prepare recovery
Daily offsite backups with tested restores turn a hack from a catastrophe into a bad afternoon. A malware scanner and file-integrity monitoring shorten the time between compromise and detection, which is the number that decides how bad things get. A web application firewall, from your host or a service, filters the commodity attacks before they reach PHP at all.
Do the basics completely and you exit the population attackers care about; they are fishing with nets, not spears.