Securing a WordPress site that keeps getting hacked

First, understand how they got in

In practice it is one of four things, in this order of frequency:

1. An outdated plugin with a public exploit.
2. A weak or reused admin password.
3. A pirated ("nulled") theme or plugin that shipped with a backdoor.
4. An outdated WordPress core.

Notice that "the server was hacked" is not on the list. Shared hosting compromises almost always start inside the site's own files.

Clean up before you harden

Hardening an already-infected site achieves nothing. Restore from a backup taken before the infection, or open a ticket and we will scan the account.

The checklist that actually works

• Turn on automatic updates for WordPress core and all plugins.
• Delete every plugin and theme you are not using. Deactivated is not deleted, and a deactivated plugin is still exploitable.
• Never install nulled software. The "free" version of a $59 plugin costs far more than $59.
• Use a unique 16+ character admin password and enable 2FA on wp-admin.
• Change the admin username away from admin.
• Set file permissions to 644 for files and 755 for directories. Never 777.
• Move wp-config.php out of the web root if your setup allows it.
• Restrict access to /wp-admin by IP if you always work from one place.

Backups are the real safety net

We take daily backups, but keep your own too — under cPanel → Backup, or with a plugin that pushes to Google Drive. A backup on the same server as the site is not a backup.

After the cleanup

Change every password: WordPress admin, cPanel, FTP and the database. Attackers frequently leave a second way back in.