Most hacked WordPress sites fall to outdated plugins, weak wp-admin passwords or pirated themes carrying a backdoor. All three are closed by a handful of settings and a maintenance routine, not by a random security plugin installed in a hurry.
Automated scanners look for plugin versions with published vulnerabilities and exploit them within hours of the announcement, however small the site is. The second route is wp-login.php, where bots try lists of leaked passwords, while xmlrpc.php lets them test hundreds in a single request. The third is the pirated theme, which ships hidden code that opens a shell or injects spam links. Permissions set to 777 complete the picture: any other account on the same server can then write to your files.
Start with updates, because they close known vulnerabilities. Next comes access: long passwords, 2FA, login limiting and, unless you use the mobile app, xmlrpc.php switched off. Then harden the files: correct permissions, DISALLOW_FILE_EDIT in wp-config.php and no PHP execution inside wp-content/uploads. Finally put a hosting-level WAF in front, which filters malicious requests before PHP starts, and check that the daily backup really restores.
If the site has forms, customer accounts or a shop, you process personal data and fall under Article 32 GDPR, which asks for technical measures proportionate to the risk. ANSPDCP has fined missing measures in Romania, so an outdated WordPress that leaks customer data is more than a technical problem. A shop that issues invoices through e-Factura must also keep the XML files sent to ANAF, which turns backups into a legal requirement.
| Measure | Attack it stops | Where to configure it |
|---|---|---|
| Updates for core, themes and plugins | Exploitation of published vulnerabilities | WordPress dashboard or WP-CLI |
| 2FA + login limiting | Brute force on wp-login.php | Authentication plugin |
| Disable xmlrpc.php | Mass password guessing in a single request | .htaccess or the web server |
| Permissions 755/644, DISALLOW_FILE_EDIT | Writing and editing files from the dashboard | File system, wp-config.php |
| Block PHP in uploads | Execution of uploaded files | .htaccess or the web server |
| Hosting-level WAF | SQL injection, XSS, bots | Hosting panel |
find /var/www/example.ro -type d -exec chmod 755 {} \;
find /var/www/example.ro -type f -exec chmod 644 {} \;
chmod 600 /var/www/example.ro/wp-config.phpdefine('DISALLOW_FILE_EDIT', true);
define('FORCE_SSL_ADMIN', true);<FilesMatch "\.php$">
Require all denied
</FilesMatch>A slider plugin left unpatched for a year let an attacker upload a PHP file into uploads, and the shop began redirecting visitors to gambling pages. Restoring the daily backup, updating and blocking PHP execution in uploads fixed it the same day.
The default admin user, with an eight-character password, was guessed through xmlrpc.php. The attacker created a hidden administrator and planted spam links in old posts. Two-factor login and disabling xmlrpc.php stopped it from happening again.
Take it offline for now, change every password, including the database and FTP ones, restore a backup from before the compromise and update everything before going live again. Check the administrator accounts and the cron entries in wp_options. Without a clean backup, look for recently modified files.
One good plugin for 2FA and login limiting is enough if the rest is in place: updates, permissions and a hosting-level WAF. Several overlapping security plugins slow the site down and add no real protection.
Apply security updates the day they appear, after a backup. Everything else can be batched weekly. Enable automatic minor core updates and check from time to time that the plugins you rely on are still maintained by their authors.
A production server starts getting attacked within minutes of receiving a public IP address, however small the project is. This guide ranks the controls by impact, from SSH access to incident response, with the Romanian rules that apply along the way. Every topic has its own page with a short answer, examples and ready-to-use configuration.