Tag
Keeping a WordPress site from getting hacked.
Themes
An admin theme changes nothing your visitors see. There are two good reasons to install one and several bad ones, and the good reasons are both about somebody else using the dashboard.
Plugins
Security plugins cover four jobs: firewall, malware scanning, login protection and monitoring. Decide which you actually need, then pick one plugin — never three.
WordPress Tutorials
Register the keys for the right version, add them to the form plugin rather than two places at once, then check that real submissions still arrive — captchas fail silently by design.
Website Building
Most compromises come from outdated extensions, weak credentials and abandoned plugins. Fix those three first — the exotic hardening tips matter far less than people claim.
WordPress Tutorials
WordPress auto-updates core, and optionally plugins and themes. Turn off what you genuinely need to control — and keep security releases automatic unless something depends on it.
WordPress Tutorials
One file holds the database credentials, the salts and every constant that changes how WordPress behaves. Know where it lives, what belongs in it, and how to keep it unreadable.
WordPress Tutorials
Roles are named bundles of capabilities, stored per user in the database. Understand the six defaults, then add or restrict capabilities without handing out administrator access.
WordPress Tutorials
Locked out with only database access? Insert a row into wp_users, then two rows into wp_usermeta that grant the administrator role. Both halves are required.
WordPress Tutorials
Five ways in, ordered by how little access they need: the reset email, WP-CLI, phpMyAdmin, a functions.php snippet and a temporary must-use plugin.
Troubleshooting
The warning means the browser did not get a valid certificate, or the page loaded insecure assets. Fix the certificate first, then the mixed content, then force HTTPS everywhere.
Troubleshooting
Cleaning malware is only half the job. Contain the site, replace core and extensions with clean copies, close the entry point, and rotate every credential before going public again.
Website Tools
Inspect response and request headers with browser developer tools or curl to diagnose redirects, caching, content types and common security settings.