Something happened. Now what?
Maybe your hosting provider sent an email about brute-force attempts. Maybe you noticed a suspicious admin user you didn't create. Maybe a client's site got defaced and you're cleaning up the aftermath. Or maybe nothing happened yet — you're just setting up a new site and want to get security right from the start.
The instinct is to install a security plugin. Wordfence, Sucuri, iThemes Security — they're powerful, but they're also heavy. Firewalls, malware scanners, login attempt databases, email alerts, settings pages with 50 toggles. For the immediate response — "lock this down right now" — that's more than you need.
Here's a 5-minute lockdown you can run from the navigator before deciding whether a full security suite is necessary.
The five-step lockdown
-archive_name=pre-lockdown so you can identify it later./wp-login.php to a custom URL. Every brute-force bot on the internet hammers the default login URL. Moving it to something like /team-portal makes those attacks hit a 404 instead. The bots don't know what to do with a 404 — they move on.When to use each level
Not every situation needs all five steps. Here's how to match the response to the threat:
Preventive (new site setup): Hide login + check updates. Takes 2 minutes. Eliminates brute-force attacks and closes known vulnerabilities before the site is even public.
Reactive (suspicious activity): Backup + hide login + debug mode + check updates. Takes 5 minutes. Preserves evidence, blocks the attack vector, and surfaces any errors left behind.
Emergency (confirmed breach): All five steps. Backup for evidence, hide login to stop ongoing attacks, debug to find traces, update everything, and password-protect the frontend while you clean up. Consider maintenance mode instead of password protection if the site shouldn't be seen at all.
After the lockdown
These five commands handle the immediate response. For ongoing security:
- Keep the login hidden permanently. There's no reason for
/wp-login.phpto be publicly accessible. Bookmark your custom URL and share it with your team. Leave it hidden forever. - Schedule weekly plugin update checks. Add the check plugin updates command to a Cron Schedule. You'll know within a day when a security patch is available.
- Schedule weekly backups. If you do get breached again, you want a recent clean backup. Not last month's — last week's.
- Change all admin passwords. This isn't a command — it's a reminder. If the site was compromised, every admin account password needs to change. Today.