WordPress Security Basics with Cloudflare
How to protect a WordPress site with Cloudflare, SSL, sensible login rules, backups and safe update habits, explained without the jargon.
Most hacked WordPress sites aren't targeted by a mastermind. They're found by bots scanning millions of sites for weak passwords and outdated plugins. A few simple habits block the vast majority of these attacks.
Put Cloudflare in front of your site
Cloudflare sits between your visitors and your server. Once your domain's nameservers point to Cloudflare, you get:
- Free SSL so every page loads over HTTPS.
- A web application firewall that filters known attack patterns before they reach WordPress.
- Bot protection and rate limiting to slow down password-guessing attacks.
- Caching that makes your site faster as a bonus.
Set the SSL mode to Full (strict) and install a valid certificate on your server too, so traffic is encrypted end to end.
Lock down the login page
The login page gets the most attacks. Protect it with:
- Strong, unique passwords stored in a password manager
- Two-factor authentication for every administrator
- A Cloudflare rule that challenges suspicious visitors to
/wp-login.php - Removing old user accounts you no longer need
Update on a schedule
Outdated plugins are the number one way in. Pick a day each week to update WordPress core, themes and plugins. Test bigger updates on a staging copy first, and delete plugins you have deactivated; inactive code can still be exploited.
Keep backups you have actually tested
A backup only counts if you can restore it. Keep automatic daily backups stored off the server (cloud storage, not the same hosting account), and practise a restore every few months. I automate this with n8n, which I explain in this post.
A simple monthly checklist
- Core, themes and plugins updated
- Unused plugins and users removed
- Latest backup restored on staging
- Cloudflare security events reviewed
Security isn't one big project. It's small, boring habits done consistently, and that's exactly why it works.
Frequently asked questions
What does Cloudflare add to a WordPress site's security?
Once your domain's nameservers point to Cloudflare you get free SSL, a web application firewall that filters known attack patterns before they reach WordPress, bot protection and rate limiting against password guessing, and caching that makes the site faster as a bonus.
Which Cloudflare SSL mode should I use for WordPress?
Full (strict), with a valid certificate also installed on your own server. That way traffic is encrypted all the way from the visitor to your server, not only as far as Cloudflare.
How do I protect the WordPress login page from attacks?
Use strong, unique passwords kept in a password manager, turn on two-factor authentication for every administrator, add a Cloudflare rule that challenges suspicious visitors to /wp-login.php, and remove old user accounts you no longer need. The login page gets the most attacks, so these four habits cover most of the risk.
Why should I delete deactivated WordPress plugins instead of leaving them?
Inactive code can still be exploited. Outdated plugins are the number one way into a WordPress site, so after updating core, themes and plugins on a weekly schedule, delete anything you have deactivated rather than keeping it around.
What should a monthly WordPress security checklist include?
Update core, themes and plugins, remove unused plugins and users, restore the latest backup on staging to prove it works, and review Cloudflare security events. Test bigger updates on a staging copy first.