Common WordPress Security Issues and Simple Steps to Prevent Them

WordPress runs a huge share of the web, so bots probe WordPress sites all day for the same handful of weaknesses. Most of them have simple fixes that take minutes. This article lists the common problems, what each lets an attacker do, and the step that closes it.

1. The common issues at a glance

For how each route works in detail, see why and how WordPress websites get hacked.

2. Outdated, unused and pirated plugins and themes

Most WordPress hacks start here. Once a plugin's security fix is public, bots scan for sites that have not updated.

• Update every week, or turn on auto-updates for the plugins and themes you trust (Plugins › Enable auto-updates). Leave WordPress's automatic core security updates on.
• Delete, do not just deactivate, plugins and themes you are not using. Their files are still on the server and can still be attacked. Keep one default theme as a fallback.
• Replace abandoned plugins. If a plugin's WordPress.org page shows no update for over a year, or says the plugin was closed, find a maintained alternative.
• Never install nulled themes or plugins. Pirated copies often contain a hidden backdoor and can never be updated. Buy from the developer or use free plugins from the WordPress.org directory.

3. Weak passwords and brute-force logins

Bots try common usernames such as "admin" with common passwords, and replay email and password pairs leaked from other websites.

Block XML-RPC if you do not use it

xmlrpc.php is an old remote-publishing interface. One request to it can test hundreds of passwords, which slips past simple login limits. Jetpack and some older publishing apps still need it. If you use neither, block it with your security plugin, or add this to the .htaccess file in your WordPress folder:

<Files xmlrpc.php>
    Require all denied
</Files>

Older guides show order deny,allow, which is outdated Apache 2.2 syntax.

4. SQL injection and cross-site scripting (XSS)

These are bugs inside plugins and themes, not settings you switch off.

• SQL injection: a plugin puts visitor input straight into a database query, and the attacker's input changes the query, for example to read user records or create an administrator.
• XSS: a plugin prints visitor input back into a page without cleaning it, so the attacker's script runs in the browser of whoever views it, possibly you, logged in as administrator.

The fix is the same as section 2: update promptly and remove what you do not need. A web application firewall is a second layer. On our cPanel servers, Imunify360's firewall runs with its full ruleset and WordPress protection on by default (measured 20 September 2026), so many common injection attempts are blocked before they reach WordPress.

5. Too many administrators

Every administrator is a full key to the site. Give each person their own login with the lowest role that works:

• Editor or Author for people who write and publish content;
• Administrator only for people who install plugins and change settings.

Remove accounts for people who have left, and check Users every month. An administrator you did not create is the clearest sign of a hack. Also look under Users › Profile › Application Passwords and revoke any you do not recognise.

6. HTTPS and SSL certificates

Without HTTPS, login passwords and session cookies cross the internet in plain text. You do not need to buy a certificate for a normal website:

• On our cPanel servers, free Let's Encrypt certificates are issued and renewed automatically (AutoSSL, measured 20 September 2026).
• On DirectAdmin and Webuzo, request the free certificate from the panel.

Then set both WordPress addresses in Settings › General to https://, and make sure plain http:// addresses redirect. A plugin such as Really Simple Security (formerly Really Simple SSL) can handle the redirect and fix mixed-content warnings. See how to enable free SSL.

7. Lock down files

Stop PHP running in the uploads folder. Images never need to execute, but a malicious upload does. Create wp-content/uploads/.htaccess containing:

<FilesMatch "\.(php|phtml|phar)$">
    Require all denied
</FilesMatch>

Test it by uploading a file called test.php there with the File Manager and opening it in your browser. You should get a 403 error. Then delete the test file.

Turn off the dashboard code editor. Add this line to wp-config.php, above "That's all, stop editing":

define( 'DISALLOW_FILE_EDIT', true );

Use sane permissions: 755 for folders, 644 for files, and 640 or 600 for wp-config.php if the site still loads. Never 777.

8. Monitoring and backups

On our cPanel servers, Imunify360 scans new and changed files as they are written and again every week, removes malicious code automatically, and keeps the original file for 14 days (measured 20 September 2026). Two things it does not do:

• you cannot start an Imunify360 scan yourself from the control panel;
• you are not emailed when malware is found or cleaned.

So add your own early warning: one security plugin, such as Wordfence, Solid Security or Sucuri Security, with email alerts for new administrators, changed files and vulnerable plugins (two security plugins together often conflict), and your site verified in Google Search Console.

For backups, our cPanel and DirectAdmin hosting runs weekly JetBackup 5 backups, keeping five copies, which you can download or restore from the panel. Treat them as a safety net and keep your own copies off the server too, because malware can sit unnoticed for longer than a week. See how to restore or download a backup with JetBackup.

If your site has already been hacked, follow the security checklist for hacked websites.

9. Where Domain India hosting fits

The host secures the server; you secure the WordPress site on it. On our cPanel and DirectAdmin servers, CloudLinux CageFS keeps each hosting account isolated from the others, and Imunify360 and the CSF firewall run server-wide, with the same configuration for every account on the server. You get the same protection on every plan, so choose a plan by resources, not security.

Plan cards show live Domain India list prices, excluding 18% GST. Hosting cannot update your plugins or stop someone who logs in with your real password, so the steps above are still yours. For the full list of tips, see useful tips to secure WordPress.

Ready to secure your site? Start with updates and 2FA today, work through the WordPress hardening guide, and open a support ticket if something on your hosting account looks wrong.