If you have never taken a single step to protect your WordPress site, you are not alone, and you are exactly who hackers count on.
Most hacked WordPress blogs I have cleaned up were not targeted. A bot found an old plugin, a weak admin password or a login page with no limits, and walked in. No drama, just neglect.
The good news is that the fixes are boring and cheap. Below are the security habits I use on my own sites, plus answers to the questions readers ask me most about keeping WordPress safe.
