How to Secure a WordPress Website (Ultimate Beginner-Friendly Security Guide)
Over 90% of hacked websites online today are running WordPress — not because WordPress is weak, but because owners do not secure it. This guide teaches you how to protect your site even if you’re not technical.
???? Introduction
WordPress powers more than 40% of the websites on the entire internet — that includes big companies, government websites, blogs, eCommerce stores, and small businesses.
Because it’s so popular, it is also the #1 target for hackers, spammers, bots, and malware. Most attacks are automated and scan millions of WordPress sites daily — including yours.
⚠️ WordPress itself is not insecure, but an unprotected WordPress installation is extremely easy to hack — even by beginners.
This article explains how to properly secure WordPress on Nairahost from the ground up — in a way that ANYONE can understand, even if you’re a young adult with no technical background.
???? Why WordPress Websites Get Hacked
Based on security research, WordPress sites are most commonly hacked because:
- Weak admin passwords
- Outdated plugins or themes
- Nulled (pirated) themes infected with malware
- No security or firewall plugin installed
- Incorrect file permissions
- Users have too many privileges
- No SSL or HTTPS enabled
???? Most hacks have nothing to do with fancy code. The #1 cause is simply people not updating WordPress or using weak passwords.
???? The Core Principles of WordPress Security
| Security Rule | Purpose |
|---|---|
| Keep WP & plugins updated | Closes known vulnerabilities |
| Use strong passwords + 2FA | Protects accounts even if passwords leak |
| Install a firewall | Blocks hacking attempts automatically |
| Disable file editing | Prevents malware from adding malicious code |
| Use SSL / HTTPS | Encrypts login and user data |
| Take regular backups | Allows fast recovery if hacked |
????️ Step-by-Step: Locking Down WordPress
Step 1: Install a Security / Firewall Plugin
Recommended FREE plugins:
- Wordfence (most recommended)
- iThemes Security
- All-In-One WP Security
These plugins will:
- Block known hacking attacks
- Detect malware
- Stop brute-force login attempts
- Warn you if files are changed
???? If you can only do ONE thing from this guide — install a firewall plugin.
Step 2: Enable Two-Factor Authentication (2FA)
Even if someone steals your password, they cannot log in without the second code.
Wordfence and iThemes both include 2FA free.
Step 3: Change Your Login Page URL
Every WordPress site uses /wp-admin. Bots know this and attack automatically.
Use WPS Hide Login to change it to something like:
https://yourdomain.com/access-panelStep 4: Limit Login Attempts
Limit failed attempts to prevent bot password guessing (brute-force):
- Wordfence → Login Security → Limit attempts
- Or install “Limit Login Attempts Reloaded”
Step 5: Install SSL and Force HTTPS
Nairahost provides free SSL via cPanel or DirectAdmin.
After installation, force HTTPS by adding this to .htaccess:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Step 6: Disable File Editing Inside WP
Add this to wp-config.php to block hackers from editing theme files:
define('DISALLOW_FILE_EDIT', true);Step 7: Remove Plugins & Themes You Don’t Use
Unused items = security holes. Delete them, don’t just deactivate them.
???? File and Folder Permission Rules
- Folders: 755
- Files: 644
⚠️ Never set folders or files to 777 — this gives full write access to attackers.
???? Avoid Nulled Themes and Plugins at All Costs
“Free” premium themes downloaded outside official marketplaces are almost always infected. You may install malware that redirects your visitors, injects ads, or steals customer data — without ever noticing.
Only install plugins from:
- WordPress.org
- ThemeForest / CodeCanyon
- Official developer website
???? Detecting Malware on WordPress
If your site is hacked, you may see:
- New admin users you never created
- Popup ads or redirects
- Google blacklisting your site
- Spam/viagra/phishing pages
- Strange PHP files in wp-content
To scan for malware:
- Wordfence → Scan
- MalCare
- SiteCheck by Sucuri
???? Backup Strategy (So You Can Recover Instantly)
Security means nothing if you cannot recover your website.
Use:
- UpdraftPlus
- JetBackup (if available on Nairahost shared hosting)
- All-in-One Migration
Best Backup Schedule
- Database: Daily
- Files: Weekly
- Store backups offsite: Google Drive, Dropbox, OneDrive
???? A backup stored inside your hosting is NOT a real backup. If the server is destroyed, your backup is destroyed with it.
???? Nairahost-Specific Security Features You Already Have
- Isolated accounts (other websites cannot infect yours)
- Automatic firewall protection
- Free SSL certificates
- Latest PHP versions
- Brute-force protection
- Secure nameservers:
- cPanel → ns1.nairahost.cloud / ns2.nairahost.cloud
- DirectAdmin → ns1.nairahost.com.ng / ns2.nairahost.com.ng
???? Final Checklist (Print or Save This)
- WordPress fully updated
- Plugins and themes updated
- Firewall installed & active
- Login URL changed
- 2FA enabled
- Admin username is NOT “admin”
- SSL installed & forced
- File editing disabled
- Backups exist and work
- No nulled plugins or themes
