Most WordPress security improvements are straightforward when they are applied consistently.

Keep software current

Outdated plugins and themes are a common source of vulnerabilities. Remove software that is no longer used.

Protect administrator accounts

Use unique passwords, limited administrator access and multi-factor authentication where possible.

Maintain independent backups

Backups should be stored somewhere other than the production server and tested before they are needed.

Use HTTPS and sensible security headers

HTTPS protects data in transit, while appropriate browser security headers can reduce several classes of client-side attacks.