Most compromised WordPress sites were not broken into cleverly. They were running an out of date plugin with a publicly known exploit. Work through this list and you remove nearly all of the risk.
- Keep core, plugins and themes updated, and turn on automatic security updates.
- Delete plugins and themes you are not using. Dormant code still executes if an attacker can reach it.
- Use a unique password for every administrator account, and enable two factor authentication.
- Never use admin as a username. It is the first thing every brute force script tries.
- Limit login attempts so repeated failures get blocked automatically.
- Disable file editing by adding
define('DISALLOW_FILE_EDIT', true);to wp-config.php. - Keep backups you control, not only the ones we take for you.
If you would rather not manage this yourself, SiteGuard Pro adds a firewall and automatic malware removal.
