This post may contain affiliate links, meaning if you decide to make a purchase via my links, I may earn a commission at no additional cost to you. See my disclosure for more info.

Nobody targets your blog personally. That’s the comforting and alarming truth about WordPress security: the attacks are automated bots probing millions of sites for the same handful of open doors, which means a small blog gets scanned just as often as a big one. It also means closing those doors is a checklist, not a career.

This tutorial is that checklist. One afternoon, no code, and your blog goes from soft target to more trouble than it’s worth. I use Jetpack’s security features on my own WordPress sites for several of the steps below, and I’ll be clear about which parts of it are free and which are paid.

What you need before you start

  • Admin access to WordPress and to your hosting dashboard
  • A password manager (any reputable one)
  • One to two hours
  • A cup of something; step 4 involves waiting for a backup

Step-by-step: secure your blog in an afternoon

Step 1: Update everything, then delete the leftovers

Outdated plugins are the number one way WordPress sites get compromised. Update WordPress core, every plugin and every theme right now, then go one step further: delete deactivated plugins and unused themes entirely. Deactivated code can still carry vulnerabilities, and code that isn’t there can’t be exploited.

While you’re in there, turn on auto-updates for plugins you trust, and put a monthly reminder in your calendar for the rest. Updates are boring. So is not being hacked.

Step 2: Fix your logins

Three quick wins. First, give every admin account a long, unique password from your password manager; reused passwords are how a leak at some random forum becomes a takeover of your blog. Second, if your username is “admin”, create a new administrator with a different name and delete the old one. Third, remove accounts that shouldn’t be there anymore: the designer from two years ago, the VA who moved on.

Then switch on two-factor authentication, so a stolen password alone isn’t enough. Jetpack supports secure authentication for WordPress logins, and it takes minutes to set up.

Step 3: Block brute force attacks

Bots guess login credentials around the clock; watch any security log for a day and you’ll see hundreds of attempts. Jetpack’s brute force protection is included in its free tier and blocks these attempts automatically before they hit your login page. Turn it on and forget about it.

This is the best effort-to-protection ratio on the whole list, which is why it’s my default recommendation for new bloggers who can’t spend anything yet.

Step 4: Set up real backups (and test one restore)

Backups are your undo button for everything: hacks, broken updates, your own mistakes. You want them automated, stored off your server, and recent. A backup sitting on the same server as your site disappears with it.

Jetpack’s VaultPress Backup (paid; check current pricing on their site) saves your site off-site in real time, so a Tuesday-morning disaster costs you minutes, not months. Good hosts add a second layer: SiteGround, where I host my blogs, includes automatic daily backups on all of its hosting plans.

Whatever you choose, run one test restore on a staging copy or a quiet evening. An untested backup is a hope, not a plan. And export the things that would truly hurt: your posts, and your email list, which deserves its own protection routine (more in my ultimate guide to email marketing).

Step 5: Add malware scanning and spam protection

Malware scanning tells you something is wrong before Google does; being flagged in search results is how most bloggers find out otherwise. Jetpack’s paid security tools include automated malware scanning with one-click fixes for common infections, plus Akismet, which quietly deletes the comment spam that would otherwise bury your inbox. Pricing varies by plan and country, so check the current numbers on their site.

On a zero budget: your host’s built-in scanner (most decent hosts run one server-side) plus WordPress’s own spam moderation settings will hold the line for a while. Upgrade when your blog starts earning.

Step 6: Get the hosting layer right

Some protection should come with your hosting: free SSL certificates, server-level firewalls, PHP version management and those daily backups. If your host offers none of that, the monthly savings aren’t worth it. This is the layer you mostly set once: confirm SSL is active (your URL should start with https), let the host keep PHP current, and leave the server hardening to them.

Step 7: Turn on monitoring

You can’t fix what you don’t notice. Jetpack’s free downtime monitoring emails you when your site stops responding, which is often the first sign of trouble, and its activity log shows who changed what and when, which turns “something broke last Tuesday” into a solvable mystery. Five minutes to enable, and you’re no longer flying blind.

Common mistakes (I’ve made a few of these)

  • Installing three security plugins. They overlap, conflict and slow your site. One good stack, configured, beats a pile of half-set-up ones.
  • Confusing SSL with security. The padlock encrypts traffic; it does nothing against weak passwords or outdated plugins.
  • Backups without restores. The first time you try a restore should not be the day you desperately need one.
  • Leaving old admin accounts alive. Every dormant account is a spare key under the doormat.
  • Doing all of this once and never again. Security is a habit; fifteen minutes a month keeps the checklist true.

If you’re securing a blog you’re still building, my ultimate guide to blogging covers the foundations this checklist protects.

FAQ

Do small blogs really get hacked?

Yes, constantly, because attacks are automated and don’t check your traffic stats first. Bots scan for outdated plugins and weak passwords across millions of sites; being small makes you obscure to people, not to scripts.

Is free Jetpack enough for WordPress security?

The free tier covers brute force protection, secure login and downtime monitoring, which is a genuinely useful baseline. Off-site backups, malware scanning and spam filtering sit in the paid plans. For a blog earning money, the paid layer is worth budgeting for; check current pricing on the Jetpack site.

Do I need a security plugin if my host is secure?

Yes. Your host secures the server; you’re responsible for the WordPress layer on top: logins, plugins, themes and user accounts. The two layers cover different doors, and most real-world compromises walk through the WordPress one.

What should I do if my blog is already hacked?

Change all passwords, restore the most recent clean backup, then update everything before the site goes back to work. If you have malware scanning, run a full scan and follow the fixes; if the infection persists, your host’s support or a professional cleanup service is the next call.

How often should I update WordPress and plugins?

Enable auto-updates where you trust the developer, and review the rest monthly. Critical security releases are worth applying the week they appear; the risk of waiting exceeds the risk of a rare update conflict, especially with backups in place.

An afternoon of setup, fifteen minutes a month, and the bots move on to easier targets. Start with the two changes that block the most attacks: update and prune your plugins today, and switch on Jetpack’s protections so the guessing game at your login page ends tonight.