- Always keep WordPress core, themes and plugins up to date.
- Don’t use
adminas the username, and use a strong password. - Only download plugins from trusted sources (wordpress.org) — “nulled” paid plugins carry malicious code.
- Install a security plugin that limits login attempts and adds two-factor authentication.
- Take regular backups.
- Enable SSL and redirect the site to HTTPS.
If you see suspicious redirects, unknown files or ads on your site, contact support right away — we’ll help clean it up.
