After the cleanup

Secure WordPress and prevent reinfection

Harden WordPress, close the security holes an attacker exploited and build the habits that prevent reinfection: strong logins, updates and backups.

A cleaned but un-hardened site often gets reinfected through the same hole. Here's the security checklist to run right after cleanup.

A good backup turns a hack into a minor setback. Here's what to back up, how often, where to store it, and how to confirm it actually works.

The wp-login.php page is the number one target for bots. Here's how to hide it, limit login attempts, and block brute-force attacks.

WordPress doesn't get hacked because it's insecure, but because of a few concrete weak spots. Here are the real causes and how to shut them down.