Most WordPress sites don't get hacked because someone specifically targeted them. They get hacked because a bot scanned a million IP addresses, found an outdated plugin or a default "admin" login, and walked right in. The good news: a handful of changes, most of them a 10-minute job in cPanel or your WordPress dashboard, close off almost every path bots actually use. Here's the checklist we run through with customers after a cleanup, so it doesn't happen twice.
How Most WordPress Sites Actually Get Compromised
Before the fix list, it helps to know what you're defending against. In order of how often we see it:
- Outdated plugins and themes with known, publicly-documented vulnerabilities. This is the biggest one by far.
- Weak or reused admin passwords, found via brute-force scripts hammering wp-login.php.
- Nulled/pirated themes and plugins that ship with a backdoor baked in from day one.
- Loose file permissions that let an attacker who got a small foothold write new PHP files anywhere.
- No firewall or malware scanning, so an infection sits undetected for weeks, quietly sending spam or mining crypto.
Almost nobody gets hacked by a targeted, sophisticated attacker. It's automated scanning, and automated scanning is exactly what hardening defeats.
The Hardening Checklist
1. Keep Everything Updated — Actually Updated
"Update later" is how sites get hacked. Log in to wp-admin/update-core.php weekly, or better, set it to update automatically for minor releases:
// In wp-config.php
define( 'WP_AUTO_UPDATE_CORE', 'minor' );For plugins, if you're comfortable with SSH and have WP-CLI installed (most SkyServer VPS and cPanel accounts support it), you can script a check:
wp plugin list --update=available --format=table
wp plugin update --allDelete plugins and themes you're not using instead of just deactivating them — an inactive vulnerable plugin is still a vulnerable plugin sitting on disk.
2. Fix Admin Credentials First
If your admin username is still "admin" or your own name, change it — attackers only need to guess the password at that point. Since WordPress won't let you rename a username directly, create a new administrator account with a proper username, log in as that user, and delete the old one (keeping its content, reassigned to the new account).
Pair that with a real password manager-generated password, and turn on two-factor authentication with a plugin like Wordfence Login Security or WP 2FA. That single step stops almost every credential-stuffing attempt cold.
3. Lock Down wp-config.php and File Permissions
Your wp-config.php holds your database credentials — it should never be world-readable. In cPanel's File Manager or via SSH:
chmod 640 wp-config.php
find /home/username/public_html -type d -exec chmod 755 {} \;
find /home/username/public_html -type f -exec chmod 644 {} \;While you're in wp-config.php, regenerate your security keys and salts using the WordPress.org key generator and paste the new block in — this invalidates any stolen session cookies.
Also disable file editing from the dashboard, which stops an attacker who gets into wp-admin from editing theme/plugin PHP directly:
define( 'DISALLOW_FILE_EDIT', true );4. Protect wp-login.php from Brute Force
A rate-limiting plugin (Limit Login Attempts Reloaded is a common free choice) locks out an IP after a handful of failed logins. If you're on a VPS and want it at the server level instead, an .htaccess rule restricting wp-login.php to your own IP works well for small teams:
<Files wp-login.php>
Order Deny,Allow
Deny from all
Allow from 203.0.113.10
</Files>Swap in your real static IP, or skip this rule entirely if your IP changes often — a lockout plugin is the safer default for most people.
5. Turn On a Web Application Firewall
If your SkyServer plan includes cPanel, check WHM/cPanel for ModSecurity or Imunify360 — both filter malicious requests before they ever reach WordPress. For self-managed VPS setups, a plugin-level firewall like Wordfence adds request filtering and malware scanning even without server-side ModSecurity rules.
6. Force HTTPS Everywhere
Mixed content and unencrypted login forms both leak session data. Confirm your AutoSSL certificate is active in cPanel, then force HTTPS redirects in your site's .htaccess:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]If you're still seeing "Not Secure" warnings after this, that's usually an AutoSSL renewal issue rather than a code problem — worth checking separately.
7. Back Up Before You Need To
Hardening reduces risk, it doesn't eliminate it. Make sure cPanel's JetBackup (or your VPS snapshot schedule) is actually running and that you've test-restored at least once. A hacked site with a clean two-day-old backup is a 20-minute fix. A hacked site with no backup is a much longer conversation.
Ongoing Maintenance
Hardening isn't a one-time task. Put these on a recurring calendar reminder, monthly at minimum:
| Task | Frequency |
|---|---|
| Review installed plugins, remove unused ones | Monthly |
| Check for core/plugin/theme updates | Weekly |
| Review admin user list for accounts you don't recognize | Monthly |
| Confirm backups completed successfully | Weekly |
| Run a malware scan (Wordfence, Imunify360, or similar) | Weekly |
None of this requires a security background. It's mostly discipline — the same handful of checks, done consistently, instead of a security overhaul after something's already gone wrong.
Frequently Asked Questions
Do I need a security plugin if my host already has a firewall?
They cover different layers. A server-level firewall like Imunify360 blocks malicious requests before they reach PHP; a plugin like Wordfence adds WordPress-specific rules, login protection, and file-change scanning. Running both isn't redundant — it's defense in depth.
How do I know if my site is already infected?
Common signs: unexpected admin users, unfamiliar files in wp-content, your site redirecting visitors to spam pages, or Google flagging it as "This site may be hacked" in search results. A malware scanner will catch most of this faster than manually digging through files.
Is it safe to use free/nulled premium plugins if I'm careful with everything else?
No. Nulled plugins are the single most common backdoor vector we see. The license fee is almost always cheaper than the cleanup.
Will disabling file editing in wp-admin break anything?
No — it only removes the built-in theme/plugin editor screens. You can still edit files via SFTP, SSH, or cPanel's File Manager exactly as before.
How often should I actually update plugins?
Weekly is a reasonable minimum. If a plugin update specifically mentions a security fix, don't wait for your weekly check — update it the same day.
