Most hacked WordPress sites are caused by out-of-date plugins or weak passwords. These steps prevent the vast majority of problems.
- Keep everything updated. Turn on automatic updates for WordPress, plugins and themes in WP Toolkit or in the WordPress dashboard.
- Delete what you do not use. Remove inactive plugins and themes. Even disabled ones can be exploited.
- Only install plugins from trusted sources, such as wordpress.org or the developer's own site. Never use "nulled" (pirated) premium plugins; they very often contain malware.
- Use strong, unique passwords for every admin user, and remove admin accounts nobody uses.
- Turn on two-factor authentication with a plugin such as Wordfence Login Security or Two Factor.
- Apply WP Toolkit's security measures. In WP Toolkit, click Security on your site and apply the recommended options.
- Take regular backups. See How do I back up and restore my website?
If you think your site has already been compromised, see My website has been hacked. What should I do?
