Why WordPress sites actually get hacked
If you want to know how to secure wordpress properly, start with how sites get compromised. The overwhelming majority of hacked WordPress sites fall to known vulnerabilities in outdated plugins, themes, or core files, for which a patch already existed. Attackers run automated scanners that probe thousands of sites for these known holes; it is not personal, it is industrial. The second most common route is stolen or weak login credentials, often reused from another breached service. Sophisticated zero-day attacks make headlines but account for a tiny fraction of real incidents. This is actually good news: it means basic hygiene stops the vast majority of attacks. You do not need to be a security expert. You need updates, fewer plugins, strong authentication, and backups. Everything in this checklist is ordered by how much protection it buys you per minute of effort (checked 14 Oct 2026).
Updates: the single biggest win
Enable automatic updates for WordPress core minor releases and for well-maintained plugins, and check for major updates weekly. Outdated code is the number one infection vector, full stop. Just as important: delete plugins and themes you do not use. Deactivated code can still be reached by scanners, so deactivation is not protection; deletion is. Replace any plugin abandoned by its developer for over a year, since unmaintained code accumulates unpatched holes. Keep PHP on a supported version too; end-of-life PHP is a silent risk because security fixes stop entirely. If a major update makes you nervous, that is what staging is for: test big changes on a copy first. Hostinger includes staging on its Unlimited and Cloud plans, which removes the excuse for updating blind. Set a recurring calendar reminder if you will not automate; the sites that get hacked are the ones nobody looked at for six months. For managed options that handle more of this for you, see best managed WordPress hosting.
Logins, passwords, and two-factor authentication
After updates, authentication is the next biggest lever. Use a unique, long password for every WordPress admin account, stored in a password manager; reused passwords from other breaches are how credential-stuffing attacks succeed. Delete the default admin username if it still exists, and give each real person their own account with the lowest role they need. Then enable two-factor authentication for every administrator and editor. A TOTP authenticator app takes about ten minutes to set up per user and blocks the credential-based attacks behind most infections. Save the backup codes somewhere safe before you need them. Limit login attempts so bots cannot hammer wp-login.php indefinitely; many security plugins do this in one toggle. If your site does not use the WordPress mobile app or remote publishing, consider disabling XML-RPC, a classic brute-force vector. These steps cost nothing and eliminate the entire class of password-guessing attacks.
Backups: your safety net when everything else fails
No defence is perfect, so plan for the day something gets through. Keep automatic, off-site, versioned backups, and test restoring one at least once; a backup you have never restored is a hope, not a plan. Know what your host provides: Hostinger includes weekly backups on Premium and daily backups on Unlimited and Cloud plans, which is a reasonable baseline, but host backups live on the host’s infrastructure. For a site that earns money, add an independent backup plugin like UpdraftPlus sending copies to separate cloud storage, so a hosting-level problem cannot take your backups with it. Back up both files and the database; one without the other is useless for a restore. After any incident, rotate your salts in wp-config.php to invalidate stolen sessions. Backups do not prevent hacks, but they turn a disaster into an afternoon of work. That difference is worth more than any security plugin. Our full walkthrough lives at Hostinger WordPress hosting with plan backup details.
How to secure WordPress with firewalls and hardening
Once the basics are covered, here is how to secure wordpress against the remaining threats. Install a reputable security plugin that provides a web application firewall and malware scanning; Wordfence and Sucuri are the established names, and either is a legitimate choice. A WAF filters malicious traffic before it reaches your login page and blocks the automated probes that never stop. Harden wp-config.php: set restrictive file permissions, disable the built-in theme and plugin editor so a compromised admin account cannot directly edit code, and force SSL for the admin area. Block PHP execution inside wp-content/uploads so uploaded web shells cannot run. Add basic security headers where you can. None of this replaces updates and backups, but together these layers mean an attacker must defeat several independent defences instead of one. Review the checklist quarterly; security is maintenance, not a one-time project. For the hosting side of the equation, compare Hostinger web hosting plans and their backup differences.
When Hostinger is enough, and when it is not
For a typical blog or small business site, Hostinger plus good hygiene is a reasonable security posture: free SSL, isolated accounts, and plan-level backups cover the fundamentals, and the price leaves room for a security plugin. But be honest about the gaps. Hostinger has no built-in WAF and no malware cleanup service; if your site gets infected, you are restoring from backup or paying someone. Support is 24/7 live chat only, with no phone line for emergencies, which matters when a store is down at midnight. Sites handling sensitive data, payments at scale, or strict compliance needs belong on managed WordPress hosts with built-in WAF, staging, and security SLAs, names like Kinsta or WP Engine, where you pay more precisely for that safety net. Security is shared responsibility: the host secures the server, you secure the application. Pick the host whose half of the job matches what your site is worth (checked 14 Oct 2026).
| Security layer | What it stops | Effort | Hostinger help |
|---|---|---|---|
| Core/plugin updates | Known vulnerabilities | Low (automate it) | One-click updates in hPanel |
| Strong passwords + 2FA | Credential stuffing | Low | No built-in 2FA; use a plugin |
| Delete unused code | Abandoned-plugin exploits | Low | Manual |
| Off-site backups | Total loss after a hack | Medium | Weekly/daily per plan |
| WAF + malware scanning | Bot attacks, injected malware | Medium | No built-in WAF; plugin needed |
| File hardening | wp-config theft, code injection | Medium | Manual via File Manager |
Cloud Startup
48-month plan, paid upfront
Renews at $25.99/mo
- Unlimited websites
- 100 GB NVMe storage
- 4 CPU cores + 4 GB RAM
- Daily and on-demand backups
- Free domain for 1 year
FAQ
Keep WordPress core, themes, and plugins updated, because most hacks exploit known vulnerabilities with existing patches. Delete unused plugins and themes, use strong unique passwords with two-factor authentication, and keep tested off-site backups. Those four habits stop the vast majority of real-world attacks.
No. Security plugins add useful layers like firewalls and scanning, but they cannot fix outdated code, weak passwords, or missing backups. Think of a plugin as a seatbelt: valuable, but not a substitute for driving safely. Start with updates, authentication, and backups first.
Two-factor authentication requires a second code from your phone app when logging in, so a stolen password alone is useless to an attacker. Install a 2FA plugin, enroll each admin, confirm one live code, and save the backup codes. It takes about ten minutes per user.
Hostinger provides free SSL, weekly backups on Premium and daily backups on Unlimited and Cloud plans, plus account isolation on shared servers. It does not include a built-in web application firewall or malware removal service, so add a security plugin for scanning and firewall protection.
Restore from a clean backup from before the infection, then change all passwords, rotate salts in wp-config.php, and scan for leftover malicious files or admin accounts. Update everything before going back online. If you have no clean backup, professional cleanup is worth paying for.
Disabling XML-RPC removes a classic brute-force and amplification vector, but some tools like the WordPress mobile app and Jetpack rely on it. If you do not use those, disabling is a safe, small win. If you do, keep it and rely on login-attempt limiting instead.