Practical WordPress security guides.

Keep WordPress, plugins and themes supported and current, use unique administrator accounts with strong passwords and two-factor authentication, maintain off-site backups, and remove unused extensions. Confirm that HTTPS works before tightening redirects or login rules.

A valid certificate helps the browser verify the website and establish an encrypted HTTPS connection. It does not remove malware or repair vulnerable plugins. Use the certificate guide for connection warnings and investigate any separate security incident on its own evidence.

The page is loaded over HTTPS but still requests one or more images, scripts, stylesheets or other resources over HTTP. Find the insecure URL, update the source safely and clear every relevant cache before testing again.

Verify that the certificate works first, then use the supported hosting or proxy setting described in the HTTPS redirect guide. Record existing settings and test full page addresses, login and checkout. For a proxy such as Cloudflare, check the connection to the host as well as the browser connection.

Changing salts invalidates existing login cookies, so users must sign in again. It is a useful response to suspected session theft, but it does not remove malware or reset account passwords.

Check which connected services require it before blocking access. The XML-RPC guide explains a full endpoint block and why some plugin restrictions cover only authenticated methods. Test the required integrations after any change.

The correct permissions depend on the server and ownership model. Files commonly use 644 and directories 755, but copying values blindly can break updates or weaken security. Confirm the hosting provider's recommended ownership and permissions first.

Protection depends on which users enrol and which login routes the chosen plugin covers. Our two-factor guide covers individual accounts and recovery tests. Hosting, email and integration credentials need their own access review; installing a plugin alone does not protect them.

Manual recovery involves more than removing a visible redirect. Start with hosting containment and a private evidence copy, then follow the malware recovery guide. Unknown code and database findings need qualified review, and a scan with no findings does not establish safety.

Get help when the site is compromised, customer data may be involved, clean files return, administrator access is lost or HTTPS changes affect checkout and integrations. Preserve logs and backups rather than repeatedly deleting evidence.