Most hacked WordPress sites are broken into through an out-of-date plugin, a weak password or an abandoned admin account, not clever attacks. These ten steps close the usual doors, and most take only a few minutes. Host Dada already scans your site for malware every day; this is your half of the job.
The 10 essentials
- Keep everything updated. Update WordPress, plugins and themes at least weekly from Dashboard → Updates. The badge in the Control Panel's WordPress Tools section tells you whether WordPress itself is up to date. Consider switching on automatic updates for well-maintained plugins from the Plugins page.
- Delete what you don't use. Deactivated plugins and themes can still be exploited. Remove them from WordPress Tools → Plugins or Themes, or from inside WordPress. Keep one default theme as a fallback.
- Only install from trusted sources. Use the WordPress.org directory or the developer's own website. Never install "free" copies of paid (nulled) themes or plugins; they very often contain hidden malware.
- Use strong, unique passwords. Every account with access to your site should have a long password that isn't used anywhere else. A password manager makes this easy. Change any password you've shared by email or with a former contractor.
- Turn on two-factor authentication. Add a two-factor plugin (such as Two Factor or one from a well-known security vendor) so administrators need a code from their phone as well as a password. Also turn on two-factor for your Client Area (see Turn on two-factor authentication).
- Review your users. In WordPress Tools → Users, check every administrator. Remove people who no longer need access and give others the lowest role that works (Editor or Author instead of Administrator). Avoid usernames like
admin. -
Check your core files. Open Checksum Report in the WordPress Tools section. It compares your WordPress files with the official versions. If files you didn't change are listed, click Replace Core Files, then Recheck.
The Checksum Report highlights any core WordPress file that doesn't match the original.
-
Use the Malware Scanner. Host Dada scans your website every day. Open Malware Scan in the Security section to see recent results, or click Start scan to check immediately, for example after removing a suspicious plugin.
Your daily malware scan result.
- Force HTTPS. Under Security → SSL/TLS, check that free SSL is active and switch on Force HTTPS so logins and forms are always encrypted. It takes up to 30 minutes to apply. See Activate free SSL and force HTTPS.
- Make sure you can roll back. Your WordPress plan includes Timeline Backups. Before big changes, open it and click Take snapshot. For extra peace of mind, keep an occasional off-site copy too (see Restore from Timeline backups).
Signs something is wrong
- Administrator accounts you don't recognise.
- Redirects to spam or pharmacy sites, especially from Google results or on mobile.
- Strange files in
public_html, or a Checksum Report full of changed files. - Google Search Console or your browser warning that the site is "deceptive" or "dangerous".
- Customers getting spam that appears to come from your website.
If you spot any of these, follow Think your site has been hacked? What to do.
Troubleshooting
I see a "Security Verification" page before the WordPress login
That's a short automatic browser check that keeps password-guessing bots away from your login page. Wait a few seconds. If it says Verification could not be completed, refresh the page and make sure JavaScript is enabled.
A plugin update broke my site
Deactivate the plugin from WordPress Tools → Plugins in the Control Panel, or restore the snapshot you took before updating. Then check the plugin's support page for a fix. See Fix the WordPress white screen or critical error.
My security plugin keeps locking me out
Deactivate it from the Control Panel's Plugins page, log in, then reduce its lockout settings or allow your own IP address.
Last reviewed: October 2026
