Why WordPress websites are targeted
WordPress is used by an enormous number of websites. That popularity is useful for site owners, but it also means attackers can automate the same checks across millions of domains. Most hostile traffic is not somebody sitting at a keyboard personally targeting your company. It is software scanning the internet for an easy opening.
A bot may test a common administrator username, look for a known vulnerable plugin, request files that should never be public, probe XML-RPC or login endpoints, submit junk through forms, or simply hammer pages until server resources are consumed. If one site does not respond, the bot moves on to the next.
Security works in layers
Think about protecting a house. You would not normally rely on one lock and declare the house impossible to enter. You might have good doors, exterior lighting, cameras, an alarm, sensible habits and insurance. Each measure solves a different problem.
Website security is similar. Cloudflare cannot fix a stolen WordPress administrator password. Two-factor authentication cannot patch a vulnerable plugin. A security plugin cannot help much if an attacker can bypass the protective edge and overwhelm an exposed server. Backups do not stop an attack, but they can make recovery possible.
The rest of this series follows those layers deliberately: Cloudflare and DNS, origin protection, firewall rules, browser security headers, administrator security, spam and bots, email, security plugins and ongoing maintenance.
Security starts before WordPress
A common mistake is to begin inside the WordPress dashboard. By the time WordPress receives a request, several other systems may already have handled it. DNS tells the visitor where to go. Cloudflare may inspect and filter the request. The hosting server accepts the connection. The web server decides how to process it. Only then does WordPress become part of the request.
That is why a secure foundation includes reputable hosting, HTTPS, properly configured DNS, sensible Cloudflare protection where used, a protected origin server and secure account access. WordPress hardening sits on top of that foundation rather than replacing it.
Before you change anything
Security changes can break perfectly legitimate functionality. A firewall can block a form. A Content Security Policy can stop a third-party script. A DNS mistake can interrupt email. A login rule can lock out the administrator who created it.
Build security habits, not a one-day project
A website that is hardened today still needs attention next month. Software changes. Vulnerabilities are discovered. Staff accounts change. New plugins are installed. Attack patterns evolve. Security is therefore a maintenance process, not a certificate you earn once.
Review updates, backups and security events on a sensible schedule. Investigate patterns rather than panicking over every blocked request. A firewall log showing blocked bots often means a layer is doing its job. What matters is whether unwanted traffic is getting through, whether legitimate visitors are affected, and whether the site remains recoverable.
Common questions
Is WordPress secure?
WordPress core is actively maintained, but the security of a real site also depends on hosting, plugins, themes, administrator accounts, configuration and maintenance. A well-maintained WordPress site is very different from an abandoned installation running years-old software.
Can one security plugin fully protect WordPress?
No. A plugin can be an important layer, but it cannot control every part of DNS, the network edge, the hosting server, email authentication, user behaviour and recovery.
Do I need to be a security expert?
No. Many of the highest-value improvements are straightforward when they are done methodically: updates, strong unique credentials, MFA, backups, HTTPS, sensible edge protection and regular testing.
Key takeaways
Next: put Cloudflare in front of the website
Part 2 follows the request outward and explains DNS, Cloudflare proxying, HTTPS and what actually happens when someone enters your domain into a browser.