WordPress core is well maintained and reasonably secure. Most hacked WordPress sites are compromised through something around it: an outdated plugin, a weak admin password, a pirated theme or a neglected hosting account. If you keep everything updated, lock down logins, install only reputable plugins and keep tested backups, you have covered the risks that matter most. This guide explains each step for South African site owners, with the settings and commands to use.
Why WordPress sites get hacked
Because WordPress powers a large share of the web, attackers build automated tools that scan for known weaknesses. They are not looking for you; they are looking for:
- Plugins and themes with known vulnerabilities that haven't been updated.
- Weak or reused admin passwords, found by brute-force or credential-stuffing attacks on
wp-login.php. - Nulled (pirated) premium plugins and themes, which frequently carry hidden backdoors.
- Abandoned plugins that no longer receive security fixes.
- Compromised hosting or FTP credentials.
Fix those five and you have removed most of the risk.
1. Update everything, regularly
- Keep WordPress core on the latest version. Minor (security) releases update automatically by default - leave that on.
- Update plugins and themes at least weekly. You can enable automatic updates per plugin from the Plugins screen.
- Delete plugins and themes you don't use. Deactivated plugins can still be exploited if their files are reachable.
- Check each plugin's "last updated" date. A plugin with no updates in a long time is a warning sign.
- Run a supported PHP version. Your host's control panel lets you choose; test your site after switching.
If you have WP-CLI access, you can update and review from the command line:
wp core update
wp plugin update --all
wp theme update --all
wp plugin list --status=inactive
2. Lock down logins
- Use unique usernames. Avoid
admin. - Use long, unique passwords from a password manager.
- Enable two-factor authentication for every administrator and editor, using a reputable 2FA plugin with an authenticator app. See two-factor authentication with an authenticator app.
- Limit login attempts, either through a security plugin or at the server level.
- Give people the lowest role they need. A content writer needs Author or Editor, not Administrator.
- Remove users who no longer work with you, and review the user list every few months.
3. Choose plugins carefully
Every plugin adds code that runs on your site. Before installing, check:
- Is it from the official WordPress.org directory or a reputable developer?
- Is it actively maintained, and compatible with your WordPress version?
- Does it have a meaningful number of active installations and responsive support?
- Do you really need it, or can a plugin you already have do the job?
Never install "nulled" versions of paid plugins or themes. The money saved is rarely worth the cleanup.
4. Harden wp-config.php
A few settings in wp-config.php reduce the damage an attacker can do:
// Stop admins editing plugin and theme code from the dashboard
define( 'DISALLOW_FILE_EDIT', true );
// Force the admin area over HTTPS
define( 'FORCE_SSL_ADMIN', true );
// Never show errors to visitors on a live site
define( 'WP_DEBUG', false );
Also make sure your security keys and salts are set to unique values; you can generate fresh ones from the WordPress.org secret-key service. Changing them logs everyone out, which is useful after a suspected compromise.
5. Sensible file permissions
On most Linux hosting, a safe starting point is directories at 755 and files at 644, with wp-config.php tighter:
find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 640 wp-config.php
Check with your host before changing permissions, as the right values depend on how the server runs PHP. On Plesk hosting, file ownership is usually set correctly for you.
6. Use HTTPS everywhere
Install an SSL certificate, redirect all http:// traffic to https://, and set both the WordPress Address and Site Address to the https:// version under Settings > General. Free Let's Encrypt certificates work well. See SSL certificates explained for fixing mixed content warnings.
7. Backups you have tested
Security is also about recovery. Make sure you have:
- automatic backups of both files and the database
- at least one copy stored outside your hosting account
- enough history to go back to before a problem started (hacks are sometimes discovered weeks later)
- a restore you have actually tried
Read our guide to a website backup strategy that works.
8. Protect the data you collect
Contact forms, WooCommerce orders and newsletter sign-ups hold personal information. Under POPIA, you need reasonable security measures (section 19) and must notify the Information Regulator and affected people if there is a breach (section 22). Collect only what you need, delete old form entries you no longer need, and never store card numbers yourself. For your specific obligations, consider professional advice.
9. Choose hosting that helps
Good WordPress hosting takes some of this off your plate:
| Feature | Why it matters |
|---|---|
| Supported PHP versions you can switch | Security fixes and performance |
| Free, auto-renewing SSL | HTTPS without effort |
| Automatic backups plus on-demand backups | Recovery after a bad update or hack |
| Account isolation | One compromised site doesn't affect others |
| Two-factor sign-in on the control panel | Protects the keys to everything |
| Local support | Help in your time zone when something goes wrong |
NewHost's web hosting runs WordPress on Plesk from Johannesburg, with free Let's Encrypt SSL.
If your WordPress site has been hacked
- Change passwords for hosting, WordPress admins, database and email, and enable 2FA.
- Contact your host - they can help identify changed files and restore a clean backup.
- Update core, plugins and themes, and delete anything unused or unknown.
- Check for unknown admin users and remove them.
- Replace your security keys and salts.
- Request a review in Google Search Console if Google flagged the site.
Frequently asked questions
Do I need a WordPress security plugin?
A reputable security plugin can add login protection, 2FA and file-change alerts, which is useful. It is not a replacement for updates, strong passwords and backups, and too many overlapping security plugins can slow your site down.
Is WordPress less secure than other platforms?
WordPress core has a strong security track record. Its popularity and huge plugin ecosystem make it a common target, so the risk depends mostly on how well a site is maintained.
How do I know if my WordPress site is hacked?
Common signs include unexpected redirects, spam pages in Google results, unknown admin users, browser warnings and your host reporting suspicious activity. Google Search Console will also alert you if it detects a problem.
Should I hide the WordPress login page?
Changing the login URL reduces automated noise but doesn't stop a determined attacker. Treat it as a small extra, after 2FA and login limiting.
Want WordPress hosting in South Africa with free SSL and automatic backups? See our web hosting plans or ask us about a migration.