Quick answer: Good WordPress security comes down to a handful of habits: keep WordPress core, themes and plugins updated, use strong unique passwords with two factor login, remove anything you do not use, choose decent hosting, and keep off site backups you have actually tested. Add a security plugin or firewall for login protection and monitoring. Most hacked business sites we see were not targeted personally. They were caught by automated attacks looking for old software and weak passwords.
WordPress itself is not insecure. The core team ships security releases quickly, and minor updates have installed automatically since version 3.7. The problems usually come from everything around the core: abandoned plugins, pirated themes, reused passwords and hosting accounts nobody has looked at in years. The checklist below is the one we work through on business sites, in roughly the order that gives the most protection for the least effort.
1. Updates: the single biggest win
Keep core current
Make sure automatic background updates for minor releases are working. You can check this under Dashboard, Updates. If your host or a developer has switched them off, find out why. For major releases, such as the move to 4.4 in December, update within a week or two once you have checked your plugins are compatible.
Update plugins and themes
Most real world WordPress compromises come through plugins and themes rather than core. Slider and gallery plugins bundled inside premium themes have been a common route in, because site owners often do not realise the theme contains a plugin that needs separate updating.
- Check for updates at least weekly.
- Read the changelog. If it mentions a security fix, update the same day.
- If a plugin has not been updated in two years, look for a maintained alternative.
Test updates on a staging copy
For sites that take orders or bookings, run updates on a staging copy first. Many hosts now offer one click staging. If yours does not, a developer can set one up.
2. Logins and user accounts
Strong, unique passwords
WordPress 4.3 started suggesting strong generated passwords when you create or reset an account. Use them, and store them in a password manager such as LastPass or 1Password. Never reuse a password that you use anywhere else.
Two factor authentication
Add a second step to logins for every administrator. Plugins such as Google Authenticator, Duo Two Factor Authentication, or the two factor options built into some security plugins work well. This one change stops most stolen password attacks.
Limit login attempts
Bots try thousands of username and password combinations against wp-login.php. Limit failed attempts with a plugin such as Wordfence, iThemes Security, or the Protect module in Jetpack.
Review user roles
- Remove accounts for staff, freelancers and agencies who no longer need access.
- Give people the lowest role that lets them do their job. Most content writers only need Editor or Author.
- Do not use “admin” as a username. If you still have one, create a new administrator and delete the old account, assigning its posts to the new user.
3. Plugins and themes
Remove what you do not use
A deactivated plugin can still be attacked if its files are on the server. Delete anything you are not using, including the default themes you will never switch to (keep one as a fallback).
Only install from trusted sources
Use the WordPress.org directory or reputable commercial developers. Never install “nulled” or pirated premium themes and plugins. They very often contain hidden code that creates backdoors or injects spam links.
Be careful with page builders and bundled extras
Large premium themes often bundle third party plugins. Keep a list of what is bundled and check whether the theme author is releasing updates promptly. If they are slow, that is a reason to rethink the theme.
4. Hosting and server settings
Your host does a lot of the security work, or fails to. Look for:
- A current PHP version. PHP 5.6 at minimum, with PHP 7.0 now available on a growing number of hosts. Very old versions such as 5.2 and 5.3 no longer get security fixes.
- Account isolation so that one hacked site on a shared server cannot reach yours.
- SFTP or SSH access instead of plain FTP, which sends passwords unencrypted.
- Server level malware scanning and a clear process when something is found.
- Daily backups held by the host, as a second layer behind your own.
File permissions and configuration
A few settings worth checking with your developer:
- Folders set to 755 and files to 644, with wp-config.php tighter where the host allows.
- Add
define('DISALLOW_FILE_EDIT', true);to wp-config.php. This removes the theme and plugin editor from the dashboard, so an attacker with a stolen login cannot edit PHP files directly. - Make sure the security keys and salts in wp-config.php are set and unique. You can generate fresh ones from the WordPress.org secret key service.
- Block PHP execution in the uploads folder.
- Turn off directory browsing.
XML-RPC
The XML-RPC file lets apps and services talk to WordPress. It has also been used for amplified brute force attacks, where one request tries many passwords. If you do not use the mobile apps, Jetpack or remote publishing, you can block it. If you do, make sure your security plugin or firewall rate limits it.
5. HTTPS
Every business site with a login form or checkout should run over HTTPS. It protects passwords and customer data in transit. Certificates have become much cheaper, and free certificates from Let’s Encrypt entered public beta in December. If you are planning the switch, our guide to moving to HTTPS without losing rankings covers redirects and the SEO side.
6. A firewall and monitoring
A security plugin or a cloud firewall adds a layer that blocks known attack patterns before they reach WordPress.
- Plugin firewalls such as Wordfence run on your server and can also scan files for known malware and changed core files.
- Cloud firewalls such as Sucuri or CloudFlare filter traffic before it reaches your host, which also takes load off the server.
Whichever you choose, turn on email alerts for administrator logins, file changes and failed scans, and make sure someone actually reads them.
Uptime monitoring is also worth having. A free service that checks your homepage every few minutes will often tell you about a problem before customers do.
7. Backups you can restore
Backups are your safety net when everything else fails.
- Back up both the database and the files.
- Store copies off the server, for example in Amazon S3, Dropbox or a dedicated service such as VaultPress.
- Keep several weeks of history. Infections are sometimes discovered weeks after they happened.
- Test a restore at least twice a year. A backup you have never restored is a guess.
Plugins such as UpdraftPlus and BackupBuddy handle scheduled off site backups well.
8. Keep it fast and lean
Security and performance overlap. A site with fewer plugins, a clean theme and good caching is easier to secure and easier to monitor. If your site has grown heavy over time, our notes on WordPress speed optimization cover the same clean up from the performance side.
What to do if your site is hacked
- Stay calm and take a copy. Back up the infected site before changing anything, so you have evidence and nothing is lost.
- Tell your host. They may already know and can help check other sites on the account.
- Change every password: WordPress users, hosting, FTP or SFTP, database and email.
- Clean or restore. Restore from a clean backup if you know when the infection started. Otherwise, replace core files with fresh copies, reinstall plugins and themes from the source, and look for unknown PHP files, especially in uploads.
- Find the way in. An outdated plugin, a weak password, or a compromised computer. If you do not fix the cause, you will be cleaning up again next month.
- Check Google. If Google has flagged the site, Search Console will show a security issues notice. Request a review once the site is clean. Our Search Console setup guide explains how to get the account ready before you ever need it.
A monthly security routine
For most business sites, this short routine is enough:
- Weekly: apply plugin and theme updates, check backup reports.
- Monthly: review users, check security plugin scan results, remove unused plugins.
- Quarterly: test a restore, review hosting and PHP version, rotate important passwords.
FAQ
Is WordPress less secure than other CMS platforms?
Not when it is maintained. Its popularity makes it a common target for automated attacks, so neglected WordPress sites get hit often. A kept up to date site with good logins and hosting is in a strong position.
Do I need a paid security plugin?
Not always. Free versions of the main security plugins cover login protection and scanning. Paid plans or a cloud firewall make sense for ecommerce and high traffic sites.
Should I hide that my site runs WordPress?
It does little harm, but it is not real protection. Bots try known attacks on every site regardless. Spend the time on updates and logins instead.
How often should I back up?
Daily for sites that change often or take orders. Weekly can be enough for a small brochure site that rarely changes.
Want a second pair of eyes on your site?
We review and maintain business WordPress sites so updates, backups and security checks happen on time, every time. See how we help sites turn visitors into customers safely.
