How to Protect Your WordPress Website from Hackers – Complete Guide
November 25, 2020
This tutorial has moved to the new WP Ghost Knowledge Base where each feature is presented in detail.
Protect your WordPress website by securing default paths with WP Ghost, enabling the 2026 Ghost Firewall, activating brute force protection, choosing secure hosting, and keeping regular backups.
Why WordPress sites get hacked
If you run a business on WordPress, you have probably asked yourself the same question every site owner eventually asks: how do I protect my WordPress website from being hacked?
It is a fair concern. WordPress runs a large share of the web, and that popularity makes it the biggest target for automated attacks. But here is the part most people get wrong: the WordPress core itself is not the main vulnerability. The real risk comes from the plugins and themes installed on your site.
Many free plugins and themes are built by developers who are skilled at creating features but not trained in security best practices. Some do not validate user inputs. Others expose file paths or leave debug information accessible. Public vulnerability databases list new plugin and theme flaws every week, so you can’t guarantee that every plugin on your site is secure at all times.
Since WordPress can not function without plugins and themes, every production website has likely had a vulnerable component installed at some point. The question is not whether your site will be targeted, but whether bots will find anything to exploit when they arrive.
Why path security matters
Every WordPress site uses the same default structure. Paths like /wp-admin, /wp-login.php, /wp-content/plugins/, and /wp-content/themes/ are identical on millions of websites. Hacker bots do not need to guess where things are. They already know.
The attack follows a simple two-phase pattern. First, the bot scans for default WordPress paths to confirm the site is a target. Second, it runs known exploits against those paths. If the bot can not complete phase one, phase two never happens. Your site stays safe because there is nothing for the bot to find.
This is the core idea behind path security. Instead of waiting for an attack to reach a vulnerable plugin and then trying to clean up, you prevent the attack from ever finding the plugin in the first place.
Default paths vs. secured paths
| WordPress Path | Default (Vulnerable to bots) | Secured with WP Ghost |
|---|---|---|
| Admin dashboard | /wp-admin/ | /your-custom-admin/ |
| Login page | /wp-login.php | /your-custom-login/ |
| Plugins directory | /wp-content/plugins/ | /custom-assets/extensions/ |
| Themes directory | /wp-content/themes/ | /custom-assets/layouts/ |
| Uploads folder | /wp-content/uploads/ | /custom-assets/media/ |
| REST API | /wp-json/ | /custom-api/ |
| Old paths accessible? | Yes (exploitable) | 404 Not Found |
How to protect your WordPress website with WP Ghost
WP Ghost was built specifically to solve this problem. Instead of scanning for malware after a breach has already happened, it prevents the breach from occurring by removing the attack surface entirely.
The plugin changes all common WordPress paths using server rewrite rules and WordPress hooks. No files are physically moved or renamed, and deactivating the plugin restores all original paths instantly.
When properly configured, WP Ghost blocks SQL injection and script injection attempts with the built-in 2026 Ghost Firewall before they reach WordPress core. It also cuts brute force and XSS attempts by keeping the login page out of bots’ sight.
Layer 1 – Path Security
WP Ghost changes and secures every common WordPress path: wp-admin, wp-login.php, wp-includes, wp-content, plugins, themes, uploads, REST API, author paths, comments path, admin-ajax.php, and more. It also hides common files like wp-config.php, readme.html, license.txt, and debug.log. Once the paths are changed, the old paths return a 404 error when bots try to access them. For the full path security guide, see Customize Paths with WP Ghost.
Layer 2 – 2026 Ghost Firewall
The built-in 2026 Ghost Firewall filters out SQL injection, script injection, XSS, file inclusion exploits and directory traversal attacks at the request level, before they reach your WordPress core or database.
Layer 3 – Brute Force Protection
WP Ghost protects your login page, registration form, lost password form, and comment forms with Math reCAPTCHA, Google reCAPTCHA V2, and Google reCAPTCHA V3. Combined with a changed login path, bots can not even find the login page, let alone brute-force it. See the full setup at Brute Force Protection.
Layer 4 – Two-Factor Authentication
Even if an attacker obtains a password, 2FA stops them. WP Ghost supports 2FA by code (Google Authenticator), 2FA by email, and 2FA by passkey, including Face ID, Touch ID, Windows Hello, and hardware security keys. All three methods are included in the free version.
Layer 5 – Security Headers
WP Ghost adds browser-level protection through security headers like Strict-Transport-Security, Content-Security-Policy, X-Frame-Options and X-Content-Type-Options. These help prevent clickjacking, content sniffing and cross-site scripting at the browser level.
Works together with other security plugins
WP Ghost can run next to other security plugins. Switch each overlapping feature (2FA, country blocking, login attempt limits) on in one plugin only. If you already use one, follow its setup guide: endpoint firewall with malware scanner, all-in-one hardening suite, bot-detection plugin or cloud firewall with site scanner. Those tools mostly scan for malware after something reached your site; WP Ghost works earlier, keeping attacks from reaching it. For a second layer, we recommend Cloudflare in front of WP Ghost.
You do not need to deactivate other security plugins when you install WP Ghost. For the full list of tested plugins, see the Plugin Compatibility List.
Choose secure hosting
Your hosting environment is the foundation of your security stack. A secure host provides server-level firewalls, automatic updates, malware scanning, and isolation between accounts. Choosing a managed WordPress hosting provider adds another layer of protection that works alongside WP Ghost.
Well-known managed WordPress hosts include WP Engine, Kinsta, SiteGround, Cloudways, InMotion, Flywheel and GoDaddy Managed WordPress. WP Ghost has setup guides for several of them, including WP Engine, Kinsta, InMotion, Flywheel and GoDaddy.
When choosing a hosting plan, make sure it includes daily automatic backups. No security setup is complete without a reliable backup strategy. If the worst happens, you need to be able to restore your site quickly.
The complete WordPress security checklist
Here is a practical checklist that covers everything you need to protect your WordPress site:
1. Install WP Ghost and activate path security. Change all default WordPress paths and hide common files. Use Safe Mode or Ghost Mode for a quick setup. Follow the Safe Mode setup guide to get started in 3 minutes.
2. Enable the 2026 Ghost Firewall. Go to WP Ghost > Firewall, switch on Firewall Against Script Injection and set Firewall Strength to 2026 Ghost Firewall. This blocks SQL injection, script injection, XSS and file inclusion attacks before they reach WordPress.
3. Activate brute force protection. Go to WP Ghost > Brute Force and enable reCAPTCHA on your login, registration, and lost password forms.
4. Enable Two-Factor Authentication. Go to WP Ghost > 2FA Login and activate at least one 2FA method for all admin accounts. Passkeys are the most secure option.
5. Run a Security Check. Go to WP Ghost > Security Check and click Start Scan. Fix any issues the scanner identifies. See the Website Security Check tutorial for details.
6. Choose secure hosting with daily backups. Make sure your hosting provider includes automatic daily backups and server-level security.
7. Keep plugins, themes, and WordPress core updated. Updates often contain security patches. Apply them promptly.
8. Use strong, unique passwords. Never use “admin” as a username. Use a password manager to generate and store complex passwords.
For the complete recommended configuration, see the WP Ghost Settings Best Practice guide.
Frequently asked questions
Is WP Ghost enough to protect my WordPress website?
For most WordPress sites, yes. The free version covers path security, the 2026 Ghost Firewall, brute force protection, 2FA with passkeys, security headers, temporary logins and the security logs. If you also want malware scanning and file integrity monitoring, a scanner can run next to WP Ghost, for example an endpoint firewall with malware scanner or a cloud firewall with site scanner. Switch each overlapping feature on in one plugin only.
Does WP Ghost replace my hosting security?
No. WP Ghost and hosting security operate at different levels. Your hosting provider secures the server infrastructure, while WP Ghost secures the WordPress application layer. Both are important. WP Ghost is compatible with all major managed WordPress hosts and their built-in security features.
Will WP Ghost slow down my website?
Not when your server reads WP Ghost’s rewrite rules. Path security works through those rules, not through database scans, and blocking bot traffic before it reaches your pages can reduce server load. The one option with a known performance cost is Text Mapping in CSS and JS files, which loads those files through PHP.
Does WP Ghost modify WordPress core files?
No. WP Ghost uses server rewrite rules (.htaccess on Apache, config files on Nginx) and WordPress hooks. No core files are moved, renamed, or modified. Deactivating the plugin restores all default paths instantly.
Does this work with WooCommerce?
Yes. WP Ghost works with WooCommerce. Cart, checkout, product pages, customer accounts and AJAX-powered features work normally with secured paths.
Do I need coding skills to set this up?
No. WP Ghost includes one-click security presets that configure the most important settings automatically. The Safe Mode setup takes about 3 minutes and requires no technical knowledge.
