Most small organization websites are hacked through the boring things: old WordPress, an abandoned plugin, a guessable admin login. Seven habits close most of that. Keep everything updated, remove unused plugins, retire the default admin name, use two step login, turn off the dashboard file editor, back up, and scan from outside.
1. Keep WordPress current
The WordPress developer handbook is direct: always keep up to date with the latest version. Automatic updates have been available since version 3.7, so turn them on for core unless a developer manages releases for you.
Download WordPress and plugins only from wordpress.org or the vendor's own site. A "free" copy of a paid theme from a random site is a common way to get malware.
2. Delete plugins you are not using
The same handbook advises deleting any plugin you are not using. A deactivated plugin still sits on the server, and its files can still be reached.
Keep a short list of the plugins you do use and why. If nobody can say why a plugin is installed, that is your answer. Keep the ones you need updated.
3. Retire obvious usernames
The handbook warns that names like admin and webmaster are typically attacked first. Create a named administrator account for each real person, move content to it, and remove or rename the generic one.
Use as few administrator accounts as you can. Editors and authors do not need admin rights to publish.
4. Strong passwords and two step login
Use a long, unique password for every account, kept in a password manager. WordPress recommends enabling two step authentication as an extra layer, and you will need a plugin or host feature for that.
Start with administrators. Then extend it to everyone who can publish.
5. Turn off the dashboard file editor
WordPress lets administrators edit theme and plugin code from the dashboard. Setting the DISALLOW_FILE_EDIT constant in the configuration file removes that. The handbook notes it will not stop an attacker who can upload files, but it can block some attacks, and it costs nothing.
6. Back up the site and database
Back up regularly, including the database. Keep a snapshot of the full installation somewhere you control, so you can rebuild and investigate after a compromise. The handbook also suggests protecting backups by encrypting them or storing them on read only media.
Restore one backup to a test location at least once.
7. Check the site from the outside
Look at your site the way a visitor or attacker does. Does the login page allow unlimited attempts? Does an old test page still exist? Is there an exposed folder listing?
A web application scan automates part of this. The demo below shows what a scan reports.
Try it yourself
Click through it at your own pace, or open it full screen.
Click through a finding and look at how the report names the page, the weakness and the suggested fix. That is what to hand your web volunteer or host.
Quick check
Is a deactivated plugin safe?
Not fully. Its files stay on the server and can carry known weaknesses. Delete plugins you do not use.
Does turning off the file editor stop all attacks?
No. The WordPress handbook says it will not stop an attacker from uploading malicious files, but it may block some attacks.
Safeguard can scan dependencies and projects you maintain, and there is a free scan at gold.safeguard.sh/scan. For people and accounts, see offboarding volunteers and staff.
Sources
- Hardening WordPress, WordPress Developer Resources
Last reviewed: 19 October 2026.
