Why do WordPress sites get broken into?
WordPress core is updated by its own project. The breaks that show up on live sites are usually an old plugin or theme, a password that is also used somewhere else, or a copy of a plugin downloaded from outside WordPress.org. Scripts try those holes on many sites at once. They are not reading your about page first.
A browser that says Not Secure is a missing certificate, not a hacked admin. Password-protecting the public site, so visitors must type a password before the homepage loads, does not close wp-login.php.
What do you change, in order?
To make your WordPress site secure, work down this list and stop when the table below passes. Stay logged in on this browser until a private window can open the dashboard.
- Open Dashboard, then Updates. Install every core, plugin, and theme update. The Updates screen should say you are up to date, and the homepage should still load.
- Open Plugins, and Appearance, then Themes. Delete every plugin and theme the site does not use. Deactivate leaves the files on disk. The lists should show only what is running.
- Open Users. If an administrator is named admin, add a new administrator, log in as that user, and delete admin. Set the public display name to a nickname, not the login.
- Set a long password that you use nowhere else, and turn on two-factor authentication for every administrator. In a private window, sign in. The site should ask for the second code before the dashboard opens.
- Cap failed logins in the security plugin you already run, or add one plugin that only does that job. After several wrong passwords from the same address, further tries should stop for a while.
- Back up the files and the database from the same moment, and store that pair off the server. The backup tool should list both parts under one timestamp.
- In a private window, open the homepage and wp-admin. You should see the padlock, then the second-factor prompt, then the dashboard. If you find unfamiliar administrators or a flood of spam posts, stop here.
One security plugin is enough for the second factor and the login cap. A second firewall plugin on the same site often blocks your own login.
| Check | Passes when |
|---|---|
| Updates | Dashboard, Updates, shows nothing waiting, and the homepage still loads. |
| Unused code | Plugins and Themes list only what the site uses. Inactive copies are deleted. |
| Login | A private window asks for the second factor, and a burst of wrong passwords stops. |
| Backup | Files and the database are one pair from the same time, stored off the server. |
| HTTPS | The homepage and wp-admin show the padlock. |
How do you know updates stuck?
After the Updates screen is clear, open one public page and wp-admin. A white screen usually means one plugin failed on the new WordPress version. In the file manager, rename that plugin's folder under wp-content/plugins, reload, then update or remove it. Change one plugin at a time.
In the host's PHP selector, choose a PHP version WordPress still supports, save, and load the homepage. If the page goes blank, switch back to the previous version before you change anything else.
How do you lock the login?
A long password on the user named admin is still an easy username to guess. The new administrator should be the only account with the Administrator role. Editors do not need it.
Two-factor authentication still holds if the password leaks. A cap on failed tries stops a script from sitting on wp-login.php. If you do not use the WordPress app or Jetpack, turn XML-RPC off, because it accepts passwords on another path.
On WordPress hosting, that login shares an IP with other accounts. Fewer bots posting to wp-login.php means less noise on that address. A person who already has the password still has to pass the second factor.
- Unique administrator login, not the name admin, with a password used only on this site.
- Two-factor authentication on every administrator.
- A cap on failed login tries.
- XML-RPC left off unless a remote publisher needs it.
Which backup can you restore?
WordPress is files plus a database. A copy of only the uploads folder cannot bring posts back. Store the pair off the server. Only sync secure copies taken at the same time: this morning's files with this morning's database.
You know it works when you restore that pair onto a staging copy and the homepage matches, or the tool shows both parts for one timestamp. A file you have never opened is not a tested backup.
Use WordPress backup when you want that copy kept with the host instead of only on a laptop. If the dashboard will not load, use the file manager to reach wp-content. Do not delete wp-config.php to try to clean the site.
When should WebJi maintain it?
Do this yourself when you can log in and you have a spare hour. Hand the work over when an update blanks the site, the dashboard already shows a hack, or nobody will run the same check next month.
WordPress security services lists Website Security Consultancy at ₹4,200 a year, before 18% GST. That line is a security audit and malware-cleanup consultancy. The figure is from the billing catalogue read on 29 October 2026.
It is not a promise that every hack is a fixed-fee clean. A larger job is quoted by email at support@webji.services before you pay. The office number is not a support line.
If unfamiliar administrators or spam posts are already there, follow the hacked WordPress guide and stop adding plugins until those extra users are gone.
Frequently Asked Questions
How do I keep a WordPress site secure?
Update core, plugins, and themes, delete anything unused, and require two-factor authentication on a unique administrator. Limit failed logins. Keep an off-site backup of the files and the database from the same time. A private window should still open the dashboard.
How secure is WordPress?
The core software is maintained and patched. Live sites usually break through an outdated plugin or theme, a reused password, or a plugin file that did not come from WordPress.org. Updating those parts matters more than stacking a second security plugin.
How can I make my WordPress site secure without coding?
Use Dashboard, Updates, Plugins, Users, and one security plugin for two-factor authentication and a login limit. You do not need to edit wp-config.php for this checklist. If strange users are already in the dashboard, stop and clean the hack before you add plugins.
How do I password-protect an entire WordPress website?
A password on the whole public site hides pages from visitors. It does not secure wp-login.php. Use a host directory password or a maintenance-mode plugin for that lock, and still turn on two-factor authentication for administrators.
What backup should I keep for WordPress?
Keep the files and the database from the same moment, stored off the server. Only sync secure copies taken together. You have a real backup when you have restored that pair, or the tool shows both parts under one timestamp.
Does WebJi clean a hacked WordPress site?
Website Security Consultancy is listed at ₹4,200 a year before 18% GST for a security audit and malware-cleanup consultancy. A job outside that line is quoted by email at support@webji.services before you pay. Do not call the office number for support.