# 10 Ways to Keep Your WordPress Site Secure

https://bihostnet.com/en/knowledgebase/article/wordpress-security-best-practices

## 10 Critical Security Measures

1. **Keep WordPress Updated** - Core, plugins and themes regularly
2. **Strong Passwords** - 16+ chars with a password manager
3. **Delete Default admin User** - Create new admin first, then delete old
4. **Enable 2FA** - WP 2FA or Google Authenticator plugin
5. **Limit Login Attempts** - Limit Login Attempts Reloaded plugin
6. **Use SSL** - Free via Let's Encrypt
7. **File Permissions** - wp-config.php: 640, folders: 755, files: 644
8. **Protect wp-config.php** - Deny access via .htaccess
9. **Security Plugin** - Wordfence or Sucuri Security
10. **Regular Backups** - UpdraftPlus with cloud storage