WordPress security — kako da zaštitite sajt od napada

WordPress runs over 40% of all sites on the internet — making it the most popular CMS platform, but also the most common target of hackers. Good news: WordPress is safe if properly configured and maintained. Bad news: most sites isn’t well protected. In this guide, we go through the security basics that every WordPress site must have.

The most common types of attacks

• Brute force — Password guessing attempts
• SQL injection — exploiting vulnerabilities in the database
• Cross-site scripting (XSS) — injection of malicious code
• Malware — virus insertion through vulnerable plugins
• DDos — site traffic overload

Basic security measures

1. Strong passwords

Not “admin123”. Use password manager (Bitwarden, 1Password) and generate long, random passwords. Specifically for the admin account.

2. Two-factor authentication (2FA)

Add a 2FA layer with Google Authenticator or similar. Even if someone gets a password, they won't be able to get in.

3. Change the default “admin” username

Use something unique. “admin” is the first thing bots try.

4. Regular updates

WordPress core, themes, plugins — everything must be up to date. 99% of hacked WordPress sites had outdated software.

5. Backup strategy

Daily automatic backup. Keep them off-site (not on the same server as the site). Tools: UpdraftPlus, BackWPup.

6. Security plugin

We Wordfence ili Sucuri — firewall, malware scanner, brute force protection. You already have Wordfence installed — just configure it.

7. SSL certificate

HTTPS is required. Most hosts offer free Let's Encrypt.

8. Limit login attempts

Block IPs that try more than 5 times. Most security plugins have this functionality.

9. Hide WordPress version

Hackers check the version first to find vulnerabilities. Hiding the version adds an obscurity layer.

10. Minimum plugin

Each plugin is a potential vulnerability. Use only those that you really need and that are updated regularly.

Advanced measures

• Change the default URL for the login page (/wp-admin)
• Disable file editing from admin panel
• Disable XML-RPC if you are not using it
• Configure .htaccess for additional protection
• Restrict access to wp-config.php
• Content Security Policy headers

What if the site has already been hacked

1. Put your site in maintenance mode
2. Identify malware (security plugin or manual)
3. Delete infected files
4. Restore clean backup
5. Change ALL passwords (admin, FTP, base, hosting)
6. Update all
7. Run a full malware scan
8. Notify users if their data may have been compromised

Često postavljana pitanja

How often should I do backup?

For active sites — daily. For static — weekly.

Is WordPress insecure by nature?

No. WordPress core is very secure. The problem is usually plugins and themes, or poor configurations.

How much does WordPress security cost?

The basics are free. Advanced measures and maintenance are usually included in the monthly maintenance package.

Need WordPress Site Protection?

Asenvirocon provides and maintains WordPress sites for Montenegrin companies — from basic security setup to complete monitoring 24/7. Zakazite konsultacije → ili pozovite +382 68 090 161.