WordPress powers over 40% of the web. That makes it the biggest target for attackers. And despite years of security awareness, the same three mistakes keep showing up on client sites we audit. None of them are complicated to fix. All of them are dangerous to ignore.
Mistake 1: Default admin usernames
If your WordPress admin username is 'admin,' 'administrator,' or your company name, you're making brute force attacks trivially easy. Attackers don't need to guess both the username and the password. They already know the username. Now they only need the password.
The fix takes two minutes. Create a new administrator account with a non-obvious username. Log in with the new account. Delete the old one. Then install a login attempt limiter that locks out IP addresses after five failed attempts. This stops 90% of brute force attacks.
Mistake 2: Outdated plugins and themes
This is the number one cause of WordPress hacks, and it has been for years. A plugin with a known vulnerability is a door left unlocked. And WordPress doesn't auto-update plugins by default (though you can enable it). So if you installed a plugin two years ago and never updated it, you might be running code with publicly documented security holes.
The fix: enable auto-updates for all plugins, or schedule a monthly maintenance window to review and update everything manually. Remove any plugins you're not actively using. Deactivated plugins are still a risk if they're installed. And check that your theme is still being maintained. Abandoned themes stop getting security patches.
Mistake 3: No web application firewall
Your hosting provider's basic firewall is not enough. It blocks network-level attacks, but it doesn't understand WordPress-specific threats. SQL injection, cross-site scripting, malicious file uploads. These all happen at the application level, and they need an application-level firewall.
A WAF like Wordfence, Sucuri, or Cloudflare's free plan adds a security layer that filters malicious traffic before it reaches your site. Setup takes less than 30 minutes. The free tiers of these tools are good enough for most small to medium sites. There's genuinely no excuse for not having one.
