How to Keep WordPress Secure

Reduce WordPress risk through maintained software, controlled access, HTTPS and tested recovery; no short checklist proves the site is secure. Stay logged in on this browser until a private window can open the dashboard.

1. Open Dashboard, then Updates. Install every core, plugin, and theme update. The Updates screen should say you are up to date, and the homepage should still load.
2. Open Plugins, and Appearance, then Themes. Delete every plugin and theme the site does not use. Deactivate leaves the files on disk. The lists should show only what is running.
3. Review all administrator accounts, remove unauthorised access through an incident procedure, and reduce unnecessary privileges. A predictable username alone is not proof of compromise; preserve ownership and reassign content before deleting a legitimate user.
4. Set a long password that you use nowhere else, and turn on two-factor authentication for every administrator. In a private window, sign in. The site should ask for the second code before the dashboard opens.
5. Cap failed logins in the security plugin you already run, or add one plugin that only does that job. After several wrong passwords from the same address, further tries should stop for a while.
6. Back up the files and the database from the same moment, and store that pair off the server. The backup tool should list both parts under one timestamp.
7. Verify a valid HTTPS connection and the intended second-factor challenge, then check the actual application. Modern browsers may not display a padlock. Successful login alone is not evidence of overall security.

Use a documented combination of security controls and test their actual coverage. A second firewall plugin on the same site often blocks your own login.

A long password on the user named admin is still an easy username to guess. Give administrator access only to the named people who require it; multiple authorised administrators can be appropriate. Editors normally do not need administrator privileges.

Two-factor authentication reduces password-only compromise risk, but session theft, phishing and recovery-channel weaknesses still need attention. A cap on failed tries stops a script from sitting on wp-login.php. If you do not use the WordPress app or Jetpack, turn XML-RPC off, because it accepts passwords on another path.

On WordPress hosting, that login shares an IP with other accounts. Fewer bots posting to wp-login.php means less noise on that address. A person who already has the password still has to pass the second factor.

• Unique administrator login, not the name admin, with a password used only on this site.
• Two-factor authentication on every administrator.
• A cap on failed login tries.
• XML-RPC left off unless a remote publisher needs it.

Do this yourself when you can log in and you have a spare hour. Hand the work over when an update blanks the site, the dashboard already shows a hack, or nobody will run the same check next month.

WordPress security services lists Website Security Consultancy at ₹4,200 a year, before 18% GST. That line is a security audit and malware-cleanup consultancy. The figure is from the billing catalogue read on 29 October 2026.

It is not a promise that every hack is a fixed-fee clean. A larger job is quoted by email at support@webji.services before you pay. The office number is not a support line.

If unfamiliar administrators or spam posts are already there, follow the hacked WordPress guide and stop adding plugins until those extra users are gone.