Start here: if you think your site has been hacked, read How to tell if your WordPress site has been hacked. If you are choosing a tool, read WordPress security alternatives compared.
If your site may be hacked
- How to tell if your WordPress site has been hackedA five-minute check and eight warning signs.
- How to fix a hacked WordPress siteWhat to do in the first hours, in order.
- How to remove malware from a WordPress siteCleaning files and the database, with commands.
- What a WordPress backdoor is and how to find oneWhere attackers keep a way back in.
Security fundamentals
- WordPress security checklist: 15 things to check todayA short list to work through on any site.
- WordPress file permissions explainedWhat 644 and 755 mean, and where each applies.
- How to secure wp-config.phpProtecting the file that holds your database login.
- What a WordPress core file integrity check isComparing core files with the official copies.
- WordPress brute-force login attacksHow they work and how to stop them.
- SSH keys vs passwords for WordPress hostingWhy keys are the safer way to log in to a server.
- How often to scan a WordPress site for malwareChoosing a scan schedule.
Hosting and firewalls
- Managed WordPress hosting security: what's coveredWhat a managed host does and does not protect.
- Do you need a firewall if you have good hosting?When a firewall adds protection.
- WordPress security without a pluginProtecting a site from outside WordPress.
Choosing a security tool
- WordPress security alternatives comparedSeven tools side by side.
- SiftWP vs WordfenceA plugin firewall and scanner against a server-side agent.
- SiftWP vs SucuriA DNS firewall against a weekly scan.
- SiftWP vs MalCareOne-click cleanup against automatic safe fixes.
- SiftWP vs PatchstackVirtual patching against checking the real site.
- SiftWP vs WP UmbrellaSite management against security.
- SiftWP vs Solid Security (iThemes Security)Login hardening against malware scanning.
About SiftWP
- How to install SiftWPConnect a site over SSH in about five minutes.
- WordPress security glossaryTerms from scan reports and advisories.
- About SiftWPWho we are and how the agent works.