Most hacked WordPress sites were not targeted personally. They were running out-of-date software or weak passwords, and automated tools found them. The good news is that a few habits prevent most problems.
Keep everything updated
WordPress, themes and plugins all need regular updates, because updates often fix security holes. Delete anything you are not using.
Use strong, unique passwords
Use a password manager, and never reuse a password from another site. Turn on two-step login for administrator accounts.
Limit who has access
Give people only the access they need, and remove accounts for people who have left.
Back up regularly, and test the backup
A backup you cannot restore is not a backup. Keep copies away from the server itself.
Use SSL
The padlock in the browser protects visitors and is expected by search engines.
Choose hosting that looks after security
Good hosting adds monitoring and protection, and someone to call if something goes wrong.
Want this handled for you? See our managed hosting.