Learn WordPress Security Essentials With This Free Course by Wordfence

Whether you know the basics of WordPress security or are totally new to the concept, there are always things to learn. It’s a dynamic field due to new threats coming out just as soon as security researchers thwart the known ones.

Let’s be clear: you don’t need to know everything to create a solid defense. Especially when you’re using tools like Wordfence that keep you covered by staying on top of the latest threats. But it helps to understand the best practices and foundational principles.

Learn from Wordfence’s Co-Founder, Mark Maunder, in our multi-part WordPress Security Essentials course. Let’s break it down, one important concept at a time.

Watch the full WordPress Security Essentials Course by Wordfence

---

---

Part 1: Why WordPress Security Matters

Watch Part 1: “Why WordPress Security Matters” On YouTube

Hacked sites can harm visitors, expose your business to legal liability, destroy trust, damage SEO, and even redirect your income. Neglecting security puts both your stakeholders and the wider web ecosystem at risk.

From a brand standpoint, security issues can cause:

• Liability issues surrounding a data breach.
• Risk of investment loss from security-related harm or destruction, such as short-term (and potentially long-term) SEO damage that could lead to de-indexation from search engines like Google.
• Employee harm if your staff is targeted, thinking another employee is contacting them — when it’s actually a malicious actor.
• Impact on revenue (e.g., malicious actors redirecting earnings to another account).

From a customer standpoint, security issues can cause:

• Damage to your brand reputation and trust with customers if they witness that your website is compromised.
• Vulnerability to brand impersonation attacks that deceive customers into downloading malware and providing additional financial data or personally identifying information (PII).

---

Part 2: Why Defense in Depth?

Watch Part 2: “Why Defense in Depth?” On YouTube

WordPress’s popularity makes it a prime target for attackers. The more security layers you implement, the better your chances of avoiding or mitigating damage from an attack.

This is also known as defense in depth: a layered approach to security that involves implementing multiple measures in tandem with each other to prevent exploits from happening.

Consider the tangible example of how a federal building uses gated parking, cameras, bulletproof glass, scanners, and entry logs. They’re all forms of layered security, offering multiple barriers to protect against threats.

Similarly, on a WordPress website, a layered approach to security involves implementing several complementary solutions, which should at least include:

• Cloudflare to protect against DDoS.
• A web application firewall (WAF) to protect against attacks on your installed plugins, themes, and the core software.
• A malware scanner for detecting and cleaning up infected files.
• Tools like Wordfence CLI for executing malware scans at an admin level.

The Wordfence Security plugin adds multiple layers of protection to WordPress sites, including a web application firewall with up-to-date threat rules, a signature-powered malware scanner (free users receive updated firewall rules and malware signatures 30 days after release), and paid features like country and IP blocking.

Whether you’re providing security for a physical building or your WordPress website, the measures you enable aren’t meant to impress but rather to benefit from a layered approach.

---

Part 3: Top WordPress Security Mistakes

Watch Part 3: “Top WordPress Security Mistakes” On YouTube

Many WordPress site owners believe keeping plugins and themes updated is enough. But zero-day vulnerabilities, abandoned software, and human errors can expose sites. Without building protective layers that include firewalls, strong login credentials, and website backups, recovery from an attack becomes far harder or even impossible.

It also doesn’t help that users who frequently treat security as an afterthought only get to realize the risk in an all too real way: after a hack or malware infection.

The reality is that even with up-to-date plugins and themes, you remain vulnerable without a dedicated security solution. For example, Wordfence’s WAF can mitigate threats from zero-day vulnerabilities by deploying new protective firewall rules even before a vendor releases a fix.

Beyond that, here are some other common WordPress security mistakes to protect your website from:

• Weak admin passwords that are easily crackable or brute forceable.
• Using plugins that have been abandoned by their creators (have no recent updates), because if a vulnerability occurs, the vendor isn’t available to release a fix.
• Not updating your WordPress website’s core software, theme, and plugin files to the latest version. This is the bare minimum when it comes to good WordPress security.
• Not creating backups regularly and automatically so that you have a working version of your website files to restore to if your website is infected.
• Having too many admin accounts. Per the principle of least privilege (which we expand on in part 6 of the course), you should hand out admin access sparingly and only give the access needed for the tasks the user is planning to complete on the site.
• Reusing passwords, because if another service has been breached, the attacker can use the shared login information to hack your WordPress admin account.
• Not using a layered approach to security (which we covered in part 2 of this course).

In part 4 (and throughout the rest of this course), we’ll discuss how to fix and defend against these top security concerns.

---

Part 4: Reducing the Blast Radius

Watch Part 4: “Reducing the Blast Radius” On YouTube

Reducing the blast radius can take a situation that could cause major reputational damage (and a negative impact on your website investment and earnings) and turn it into a situation that’s quickly rectified without brand and bottom-line harm.

After all, there will be situations where even your best efforts to create a proactive, layered approach to security aren’t enough to stop savvy bad actors who find new ways in. Thus, the blast radius can be defined as the total breadth of damage to a site that’s compromised.

To minimize the blast radius, incorporate these control measures:

• Host each of your sites in its own isolated file system. This is because if multiple sites share the same file system, a hack on one can compromise them all, turning one breach into a large “blast radius.” Isolating each site ensures that if one is compromised, the others remain safe.
• Back up your site(s) regularly because backups are essential for security and general site management. Backups allow you to restore files after a hack or revert to earlier versions if something goes wrong.
• Don’t reuse passwords because using the same password across accounts means one breach can expose many services: from your website to email, cloud storage, and more.
• Use an early detection system, which involves installing and configuring a plugin like Wordfence to enhance your WordPress security.
• If you’re hacked, be transparent with your users. You can minimize potential brand reputation harm by getting ahead of the situation if a breach occurs. Let affected users know and communicate in an ongoing, transparent way.

---

Part 5: What Hackers Really Want From Your Website

Watch Part 5: “What Hackers Really Want From Your Website” On YouTube

Many site owners wrongly assume they’re too small or unimportant to be attacked. However, attackers often exploit large numbers of small, insecure sites for income or larger attacks. Understanding these motives helps owners take security seriously before a breach happens.

Ecommerce sites are prime targets because hackers can directly profit by injecting malware that steals customers’ credit card data during transactions. But attackers also value other WordPress sites, especially when they can control and exploit hundreds of compromised sites at scale.

Specifically, attackers exploit vulnerabilities to their advantage to:

• Steal email addresses from your user accounts database. After compromising enough sites, hackers can sell these in bulk on the black market.
• Run for-profit ads by injecting their ads into content and making money from impressions and conversions. Savvy attackers can even detect when a logged-in admin user is on the page, hiding the ads from view and making the issue difficult to detect.
• Launch distributed denial of service (DDoS) attacks on other websites and users from your website, along with other sites they’ve compromised, to target other (perhaps more valuable) targets.
• Use your site’s resources to run software that generates cryptocurrency.
• Injecting SEO spam to steal traffic and generate revenue by massively expanding the total number of pages on your website in a way that you’re not even aware of what’s happening.
• Hosting illegal content, which could implicate you and cause legal trouble.
• Utilizing a clean IP address — which hasn’t previously been associated with malicious acts — to launch new attacks.

---

Part 6: The Principle of Least Privilege

Watch Part 6: “The Principle of Least Privilege” On YouTube

Restricting privileges reduces the risk of a compromised account leading to a full site takeover, especially if passwords are reused or two-factor authentication isn’t enabled.

That’s why, beyond WordPress security, the principle of least privilege is fundamental to cybersecurity best practices and should be followed by your organization’s users across all necessary accounts.

It’s something we follow at Wordfence, and you should, too.

At its core, it means that for all the accounts on your site (or across your organization), you’re only giving users the access they need to do the job they’re logged in to do. For example, a publisher should be limited to the access required to publish because, to do so, they don’t need full admin rights.

After all, not everyone should have admin access; just a few necessary users.

Be clear with your team that access isn’t about ego or recognition. Just because you’re a manager doesn’t mean you should have access to everything, such as the ability to take actions that aren’t typical for your role.

Consider a situation where a user reuses a password, and the site where they have an admin account doesn’t have 2FA (two-factor authentication) enabled. If everyone’s an admin, the chances of a breach from a malicious hacker reusing login information become more likely. But if fewer users have admin access, you’re effectively reducing that attack surface — even if you still aren’t following best practices around enabling 2FA and limiting password reuse.

---

Part 7: How WordPress Sites Get Compromised

Watch Part 7: “How WordPress Sites Get Compromised” On YouTube

Some of the most common attack vectors we see when WordPress sites become compromised are vulnerable themes and plugins.

For a first line of defense, run a security plugin with a built-in WAF like Wordfence. That way, even if a plugin or theme is vulnerable, and the vendor hasn’t yet released a fix, a firewall rule can be released to protect and mitigate the damage to your site and others that have installed the Wordfence Security plugin.

Another common attack vector is admin password reuse. If another service (e.g., a forum or hosting service accounts) is breached and its passwords match your WordPress admin credentials, attackers can brute force their way in. Prevent this by using unique passwords, a password manager, and enabling 2FA.

Old and outdated PHP versions can also cause issues. Newer versions do a better job of securing your site and protecting against certain types of vulnerabilities.

Also, be careful where you enter credentials — you may be entering them somewhere that isn’t actually your site, but an attacker phishing you. Lastly, be aware of supply chain attacks that happen when a plugin developer’s account is hacked and a malicious update is pushed to your site. They’re rare, but they do occur.

---

Part 8: The Biggest Source of WordPress Vulnerabilities

Watch Part 8: “The Biggest Source of WordPress Vulnerabilities” On YouTube

Plugins are the main source of WordPress vulnerabilities, so you should prioritize updates and plugin management. Here’s our breakdown of our research covering the total number of WordPress vulnerabilities in 2024:

• 8,066 WordPress plugin vulnerabilities
• 345 WordPress theme vulnerabilities
• 5 WordPress core software vulnerabilities

Note that a vulnerability may have more than one software type, or multiple pieces of affected software, leading to a higher count.

More than 7% of these vulnerabilities were classified as high threats, with the potential for mass exploitation.

Additionally, there was a 68% increase in measured WordPress vulnerabilities since 2023. This isn’t necessarily a bad thing, because they’re vulnerabilities that are being responsibly disclosed by researchers, but it is a potential indicator that the ecosystem as a whole is becoming more secure.

Wordfence funds a lot of this vulnerability research through our Bug Bounty Program. We confidently disclose the results to vendors, which results in more vulnerabilities being fixed.

---

Part 9: Essential Security Practices for Every WordPress Install

Watch Part 9: “Essential Security Practices for Every WordPress Install” On YouTube

As we’ve shared throughout the course, you have a lot to lose and malicious actors have a lot to gain if your WordPress site is attacked. With that in mind, here’s a quick rundown of some of the best security practices to safeguard your site.

Start by installing Wordfence. It offers multiple layers of site security and will guide you through making good choices for securing your site. The Wordfence plugin offers immediate access to a WAF (Web Application Firewall), a malware scanner, and 2FA (two-factor authentication) for login security. On that note, immediately enable 2FA on all admin and user accounts.

Also, recall what we learned about the principle of least privilege in part 6 of this course, which is to only hand out privileges on accounts that actually need them to do the job they need to do on your WordPress site.

Moreover, get rid of unnecessary accounts, especially unnecessary admin accounts, to minimize the blast radius we discussed in part 4 of this course. You can also reduce the blast radius by getting rid of inactive plugins, themes, and scripts that you don’t need and aren’t using. It’s less to maintain and protect against.

One of the most fundamental rules of WordPress security is to regularly update WordPress core, plugin, and theme files. On a related note, keep regular backups of your site so that if there’s an incident where files are deleted or corrupted, you have a copy of the files to recover from. Even better? Keep backups offsite, not on the same file system as your live site.

Finally, eliminate password reuse, especially among admin users. You can use a password manager to enforce unique passwords across accounts.

All of these practices are examples of a layered approach to security, a concept we discussed in depth in part 2 of this course. Doing all of these things will provide the best defense against malicious attacks. To keep track of the practices you’ve implemented, check out our WordPress security checklist.

---

Part 10: Signs Your Website Might Be Hacked

Watch Part 10: “Signs Your Website Might Be Hacked” On YouTube

Overall, some attacks are more nuanced and difficult to detect. That’s why you need good monitoring on your site and a WordPress security solution like Wordfence to track odd behaviors and scan for malware.

Still, here are some of the top signs that your WordPress website may have been attacked:

• Unfamiliar accounts or plugins installed are an early indicator of compromise.
• Your website’s IP address is blocklisted, which often means your site is being used for spam or attacks.
• Admin users or customers experience unexpected website redirects.
• Your username or password does not work when you try to log in (related: the “forgot password” functionality isn’t working).
• Strange results from search engine results pages (SERPs), which may indicate a hacker using your site to host their own content.
• Alerts from your site’s security plugin; alert volume increasing.
• Website performance issues, like drops in website speed or increases in resource usage and network bandwidth usage increasing exponentially without explanation.
• User reports of errors (which should be investigated immediately).
• Drop in revenue from earnings — it might have been redirected to a malicious actor’s account.

---

Watch The Entire WordPress Security Essentials Course By Wordfence (Full Playlist)

You don’t have to be a cybersecurity expert to follow best practices that can secure your WordPress site from the worst threats.

Watch our WordPress Security Essentials course for the most important steps you can take to protect your website — all in under 30 minutes.

While you’re at it, install Wordfence Free for immediate access to our WAF, malware scanner, and 2FA login security features. To optimize site security with remediation for security incidents, choose Wordfence Care. And if you’ve been hacked, check out Wordfence Response so our threat intelligence team can help your site get you back on track.