Almost nobody gets hacked by a genius. WordPress sites fall to bots running the same three plays all day: known holes in outdated plugins, password guessing on the login, and uploads folders that execute whatever lands in them. Close those doors and you’re ahead of the traffic. You’ll need admin access, SFTP or SSH, and an hour — no paid security suite required. (For the why behind all of this, there’s how website security updates work.)

Update everything first (that’s most of it)

The single biggest cause of hacked WordPress sites is a plugin with a published vulnerability, still installed, months after the fix shipped. Check where you stand:

wp core check-update
wp plugin list --update=available
wp theme list --update=available

Then update, using the careful sequence from updating WordPress without breaking it. While you’re in there, remove the plugins you don’t use — a deleted plugin has no vulnerabilities.

Enforce strong logins and two-factor

Bots guess passwords around the clock, and they’re good at it. Every account gets a long generated password from a password manager, and every administrator gets two-factor — install a small dedicated plugin like “Two-Factor” (WordPress’s own) rather than a mega-suite. If any account is still named admin, make a new admin with a boring unguessable username and delete the old one, reassigning its content when prompted.

Audit the admin accounts

Administrator is for people who administer. List who has it:

wp user list --role=administrator --fields=user_login,user_email,user_registered

The designer from 2021, the plugin vendor’s support login, the account nobody recognizes — demote them to Editor or delete them. Every admin account is a full set of keys, and fewer keys means fewer things to steal.

Turn off what you don’t use: XML-RPC, file editing

XML-RPC is a legacy remote-publishing API that today mostly serves as a second front door for brute-force bots. Unless something you rely on needs it (the Jetpack app is the common one), turn it off in a small must-use plugin, wp-content/mu-plugins/hardening.php:

<?php
add_filter( 'xmlrpc_enabled', '__return_false' );

Then disable the built-in code editor, which turns any stolen admin login into instant PHP execution. In wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

Set sane file permissions

From the site root, directories get 755, files get 644, and wp-config.php gets tighter because it holds your database password:

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 600 wp-config.php

The uploads folder has to stay writable, so tell the server never to execute PHP from it. On Apache, drop this in wp-content/uploads/.htaccess (on nginx, ask your host for the equivalent location block):

<Files "*.php">
  Require all denied
</Files>

Strong passwords win the guessing game, but there’s no reason to let bots play for free. A small plugin like Limit Login Attempts Reloaded locks out repeat failures; if the site sits behind Cloudflare, a rate limit on /wp-login.php does the same job before the traffic ever reaches PHP. Either one turns ten thousand guesses a day into a handful.

Verify with a scan

Now prove it. Confirm example.com/xmlrpc.php returns a 403 or an error page, confirm the Theme File Editor is gone from the admin’s Appearance menu, and upload a harmless test.php to uploads and confirm the browser refuses to run it (then delete it). Run the free WPScan online check against your domain and confirm it finds no known-vulnerable versions. Total time from a bot’s perspective: they knock on four doors and every one is locked, so they go bother somebody else’s site. That’s the whole game.