WordPress powers 40%+ of the web, which also makes it the most heavily targeted CMS by automated attack tools. Most compromises aren't sophisticated — outdated core/plugin versions, weak admin credentials, or nulled plugins with backdoors baked in. Here's a hardening checklist ordered by priority.

Stay current — the cheapest security you'll ever get

Enable core auto-updates in wp-config.php:

php

define( 'WP_AUTO_UPDATE_CORE', true );