Short answer: Website security means lowering the risk of a break-in, because no system is perfectly secure. Use long passwords with two-step sign-in, give each person only the access they need, and keep WordPress, themes and plugins up to date. Then check Site Health in WordPress and the Security issues report in Search Console.
Who keeps your website safe
Your host is often responsible for the infrastructure your site sits on, but not for the software you install, such as WordPress and its plugins. WordPress adds that hacks rarely come from the infrastructure and most often from the application, the part you are responsible for.
Among the qualities of a trusted host, WordPress lists talking openly about security, running recent stable server software and providing reliable backup and recovery. Our guide to web hosting covers how to choose one. Keep your own computer free of malware too: WordPress warns that no site security helps if it has a keylogger, a program that records what you type.
Passwords that are hard to guess
NIST, the US agency behind widely used digital identity guidelines, recommends passwords of at least 15 characters. Length matters most, and NIST no longer recommends requiring special characters and numbers.
A passphrase, several real words put together, is easier to remember. Use a different password on each site: NIST notes that one leaked password can open every site where you used it.
NIST experts highly recommend a password manager, an app that creates long passwords and stores them for you. Choose one that supports two-step sign-in, since its login protects all the others. WordPress also shows a strength meter when you change a password.
Add a second step to your sign-in
Two-step sign-in, or multi-factor authentication (MFA), asks for something more than a password, such as a code from an app or a security key. If someone steals your password, NIST says MFA puts a second barrier in their way, and it recommends MFA on every account that offers it.
WordPress core doesn’t include it. Its handbook says to add it with a reputable plugin or your identity provider, and to turn it on for all administrators.
NIST says text message codes are particularly vulnerable, and that admins should at least be offered phishing-resistant methods. Passkeys are one of them: you sign in with the PIN or the face that opens your phone, and NIST says they can’t be easily stolen through phishing. WordPress suggests adding them with a maintained plugin.
Give each person only the access they need
WordPress advises limiting the number of administrators and using least-privilege roles for day-to-day work. NIST adds that access should go only to those who need it, and be removed when needs change or someone leaves.
| Role | What WordPress lets it do | Who usually gets it |
|---|---|---|
| Administrator | Everything in the administration of a single site | The owner, and whoever runs the site |
| Editor | Publishes and manages posts, including those of other users | Whoever runs the blog or the news |
| Author | Publishes and manages their own posts | A regular writer |
| Contributor | Writes and manages their own posts, but can’t publish them | A guest or occasional writer |
| Subscriber | Only manages their profile | Registered readers or customers |
WordPress documentation, read on November 7, 2026. The last column is our own advice.
WordPress creates an Administrator account when you install it. Don’t use admin as the username, and demote or remove old users on the Users screen. For an app or service that connects to your site, use Application Passwords: you can revoke one without changing your own password.
Updates, plugins and backups
Older versions of WordPress don’t get security updates. Once a fix comes out, WordPress says the information needed to exploit the flaw is almost certainly public, which makes old versions more open to attack. WordPress has offered automatic updates since version 3.7.
Plugins have deep access to your site, the Site Health documentation notes. Get them from the WordPress.org repository or well-known companies, keep them updated, and delete any plugin or theme you don’t use.
WordPress recommends tested backups, a practiced restore and regular copies of the whole site, so you can rebuild from a version made before an attack. Our website maintenance guide covers how often to back up and update.
Slow down attacks on your login
In a brute force attack, someone tries username and password combinations until one works. The attempts are automated, WordPress notes, and even failed ones can overwhelm your site with requests.
WordPress recommends limiting login attempts at a firewall, a content delivery network or the web server. A security plugin can do it too, though it uses server resources during a heavy attack. A CAPTCHA on the login page slows bots down, and our CAPTCHA guide covers the options.
If you don’t use XML-RPC, a connection some apps and services rely on, WordPress says to disable it, because attackers target it often. Hiding the login address can cut the noise, but WordPress says it shouldn’t be your only defense. Serve the whole site over HTTPS so passwords travel encrypted; our SSL certificate guide shows how.
Check your site in WordPress
WordPress diagnoses your site in Site Health, under Tools in the dashboard. The Status tab sorts the findings into critical issues, recommended improvements and passed tests.
Critical issues can be potential security holes or serious performance problems, and Site Health suggests how to fix each one. Examples include background updates that don’t work, an outdated version of PHP and plugins waiting for updates.
The Info tab shows whether your site uses HTTPS, and its User count. In our view, if that count is higher than the people you gave access to, check the list under Users.
Check what Google found
The Security issues report in Search Console shows what Google found if it decides your site was hacked or could harm visitors. Google sorts the issues into hacked content, malware and unwanted software, and social engineering. With no issues, you see a green check mark.
Affected pages can carry a warning in search results, and the browser can show a warning page before the visit. You may not see it on your own screen, since Google says its warnings depend on the browsing context: rely on the report. Our Search Console guide shows how to set it up.
If Google flags your site
Open the issue in the report, follow its Learn more link and use the sample pages to find the problem. Fix it across the whole site, since Google says fixing only some pages won’t earn a partial return to search results.
When every listed issue is fixed and tested, select Request Review and describe your fixes. Google says most reviews take several days or weeks, with an email when it gets the request and another when it’s done.
Don’t send another request before a decision: one sent before the issue is fixed can slow the next review. In our view, once the site is clean, change the passwords of every account with access.
How to secure your website
- Keep every password in a password manager, with at least 15 characters and none reused.
- Turn on two-step sign-in for every administrator, with a passkey or an app if you can.
- Give each person their own user and the lowest role that does the job.
- Turn on automatic updates, and delete the plugins and themes you don’t use.
- Limit login attempts at your firewall, content delivery network or web server, and disable XML-RPC if you don’t use it.
- Open Tools > Site Health and fix the critical issues first.
- Check the Security issues report in Search Console every month.
The order and the monthly check are our own advice. The rest follows WordPress, NIST and Google.
Your website security checklist
- Every account has its own long password, stored in a password manager.
- Every administrator signs in with a second step.
- Only the people who need it are administrators, and nobody signs in as admin.
- WordPress, the theme and the plugins are up to date, and unused ones are gone.
- A recent backup exists, and you know how to restore it.
- Site Health shows no critical issues, and Security issues shows a green check mark.
RememberYour host protects its servers, and the site itself is your job. Use long passwords and two-step sign-in, keep roles small and software current, and check Site Health and Search Console.
Our web design service builds in WordPress and hands you every login. If you want, its monthly maintenance tests updates before they go live, keeps daily backups for 30 days and monitors security and downtime.
Questions about website security
How do I check if my website is secure?
In WordPress, open Tools, then Site Health, and fix any critical issues. Then open the Security issues report in Google Search Console, where a green check mark means Google found no issues.
Does WordPress have two-factor authentication?
Not in WordPress core. The WordPress handbook says to add it with a reputable plugin or your identity provider, and to turn it on for all administrators. The extra step can be an authenticator app or a hardware key, with a text message as a fallback.
Why does Google show a warning for my site?
Google flags pages it finds hacked or harmful to visitors, for example through phishing or malware. They can carry a warning in search results or show a warning page in the browser. The Security issues report in Search Console says what Google found.
How long does a Google security review take?
Google says most reviews take several days or weeks. It emails you when it receives your request and when the review is complete. Don’t send another request before you get a decision.
How long should a password be?
NIST recommends at least 15 characters, and no longer recommends requiring special characters and numbers. A passphrase of several real words is easier to remember, and a password manager can create a long, different password for each account.
Sources
Sources read on November 7, 2026. From WordPress: Hardening WordPress. Brute Force Attacks. Roles and Capabilities. Site Health screen. From NIST: How Do I Create a Good Password? Multi-Factor Authentication. From Google Search Console Help: Security issues report. From our site: our web design page.