Tips to Improve WordPress Security

I wrote this post in Spanish in 2021 and adapted it to English in 2026.

WordPress means power.

There's nothing you can't do with this CMS, and since the WP 5 updates it's honestly a pleasure to use.

Buuuuut...

There are some little details they need to polish, and one of them is WordPress security.

At the end of 2020 and the start of 2021, almost all my sites were sending me emails about failed login attempts.

Pure brute force, trying to guess the password.

(In a couple of cases they got the username right, and no, it wasn't "admin".)

Failed Login Attempts in WordPress: How Do You Fix Them? #

Easy.

With a WordPress security plugin that limits failed logins and blocks the IPs they tried to log in from.

Limit Login Attempts, Loginizer and friends are very effective.

What happens when the attacker seems to have unlimited IPs?

If the attacks keep coming, there are a couple more steps.

The first is changing the login URL, and this is a pretty serious WordPress security flaw.

Because by default, every new install has the dashboard login at the same URL: yourdomain.com/wp-admin

That leaves your site very exposed.

Because even the dumbest hacker in history knows that's the URL to attack.

It's an easy fix. A really easy fix.

Install WPS Hide Login, a plugin that doesn't touch your database or .htaccess, to change the URL you use to log in to WordPress (don't use /login/, the plugin's default login URL).

Still getting failed login attempts on your WordPress site? xmlrpc.php may be messing with you

If they keep attacking you, it's because WordPress has another security flaw: they haven't removed xmlrpc.php.

A damn file that, back in the days of the dinosaurs, was used to publish posts from your email.

Today it's only used to publish from the iPhone app.

And it leaves the door open for your website to be hit with login attempts.

Blocking or disabling xmlrpc.php for better WordPress security

You need to use your .htaccess file to solve the problem.

Paste this code at the end:

# block xmlrpc.php
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>

With that, they won't keep attacking you.

Because (unless you have a virus in your browser) they won't be able to guess your new login URL.

And they don't have remote access.

Is there any downside to blocking WordPress's xmlrpc.php?

Everything has a price...

In this case, the price is that plugins like Jetpack will stop working.

So check whether any of your plugins use xmlrpc.php before blocking it completely (you can block just some of its features).

How Can You Use WordPress Backups to Remove Malware After an Attack? #

Another ace up your sleeve, one you can keep handy to save you from all evil, is WordPress backups.

They're easy to make. There are WordPress backup plugins galore that make them in a couple of clicks.

They're very useful for security, and I'll show you how to use them. But first... a bit of context!

• What are hackers after when they attack your website?
• What do they do once they've broken through your security?
• What other security holes should you watch out for?

Let's start with the first point.

1) What are hackers after when they break into your WordPress site?

Traffic.

That's the short answer.

Most of them just want your traffic so they can monetize it themselves.

If you think about it, it makes total sense.

Why?

Because asking you for a ransom for your website is a crime.

But...

Stealing your traffic and then monetizing it with their own ad systems is perfectly legal.

2) What do they do once they've broken through your WordPress security?

There are two big patterns here.

Once they have access to your website they can do whatever they want, but these two are the ones I see most often:

• Creating pages on your site.
• JS redirects.

When they create pages on your site, they get traffic, links and money (monetizing with their own ads).

When they redirect with JS (JavaScript, for the uninitiated), they just steal your traffic, plain and simple.

Both methods are very clever ways to break WordPress security.

Because if you have several niche sites, it'll take you a while to notice there are a thousand pages you didn't create, or that your traffic is being stolen (the JS redirect waits a while before redirecting the user).

What makes them clever is that in neither case do you lose traffic.

Only income.

And if your other niche sites are doing well, it'll be really hard to notice something's wrong with a couple of them.

3) What other WordPress security holes should you watch out for?

Plugins.

They're wonderful.

In a nutshell, they're the secret behind WordPress's success as a CMS.

You can build a whole website out of plugins, with very little programming knowledge.

But they're a double-edged sword.

The reason is that they can be hit by zero-day exploits.

What the heck is that, and what does it have to do with WordPress security?

Flaws the developer doesn't even know exist.

And if it happens to almighty Windows, just imagine whether it can happen to a plugin developer.

Hackers are very smart. Super intelligent people who, instead of curing cancer with that talent, decided to steal using a computer. And they keep a close eye on the plugins with the most installs, to take advantage of their zero-day exploits.

As if that weren't enough, check this out:

Plugins themselves can have bugs and flaws that completely break your website (wiping the database, for example).

That includes WordPress security plugins (so be careful with "the cure", because it can be worse than the disease).

That's been the case with Yoast SEO, which has burned plenty of colleagues with several of its updates.

So it's not just hackers.

The plugin vendor itself can leave your place a total mess, with you sweating to get your site back.

What Can You Do to Fix These WordPress Security Problems? #

If you want to improve your WordPress security, you need to lean on your website's backups.

These 3 problems I mentioned are all rooted in the database.

By swapping your current database for a backup from before the estimated date the problem started, you'll have fixed everything.

"Oh, but my backup is really old, I'll lose some of my work."

You have to decide whether you'd rather lose some of the work you've done, or keep losing traffic and SERP positions while you try to find a fix for the problem...

What Does Good WordPress Backup Management Look Like? #

Saint Google gives you 15 GB of cloud storage for creating a Gmail account.

Create an account that you'll only use to store your sites' backups.

When should you back up WordPress?

Every time you're about to make a major change to the website:

• Design and layout changes.
• URL architecture.
• Publishing content in bulk.
• Etc.

After every big change, update the backup you keep of the website.

That's all for today. I hope this post was useful, and if it was, share it on social media with your colleagues. And if it wasn't, well, share it anyway!