WordPress is not insecure. Sites running it get compromised for four reasons, in this order of frequency, and none of them is a flaw in WordPress itself.
1. A plugin that was not updated
By far the largest cause. A vulnerability is published, a scanner finds every site still running the old version within days, and the rest is automatic.
- Turn on automatic updates for plugins you trust.
- DELETE what you do not use. An inactive plugin is still a file that can be reached directly.
- Check whether a plugin has been abandoned - "last updated 3 years ago" is a decision to stop using it.
2. A password used somewhere else
Leaked from an unrelated site and tried here. Two-factor makes the leak irrelevant, which is why it is worth more than any plugin.
3. Uploads that execute
If a file placed in wp-content/uploads can be run as PHP, an upload form is a way in. Close it at the server, not with a plugin.
location ~* /wp-content/uploads/.*\.(php|phtml|phar)$ {
deny all;
}
4. Editing files from the dashboard
The built-in editor turns a stolen admin session into arbitrary code on your server. Almost nobody uses it deliberately.
define('DISALLOW_FILE_EDIT', true);
Three more that cost nothing
- Move wp-config.php above the web root, or deny it explicitly. It holds the database password.
- Turn off XML-RPC unless something needs it - it is a common brute-force target.
- Hide the version. It is not security, but it removes you from searches for "sites running version X".
After any compromise, change the salts in wp-config.php. It invalidates every session, including the attacker's, and it is the step most cleanups miss.