WordPress Security: A Checklist That Prevents Most Hacks
Nobody is personally targeting your plumbing company's website. What happens is far more mundane: a vulnerability is published, automated scanners sweep the internet for sites still running the vulnerable version, and yours answers. That is why the boring measures below stop nearly everything.
How WordPress sites actually get compromised
| Route in | Roughly how common | Prevented by |
|---|---|---|
| Outdated plugin or theme | Most common by far | Prompt updates |
| Weak or reused passwords | Common | Strong passwords + 2FA |
| Nulled / pirated themes | Common | Never using them |
| Outdated WordPress core | Less common | Automatic minor updates |
| Compromised hosting | Uncommon | Reputable host |
The pattern is consistent: known problems, already fixed upstream, left unpatched. Security here is far more about maintenance discipline than clever defences.
The essentials
Keep everything updated
- Enable automatic updates for WordPress minor releases
- Update plugins weekly — test on staging first if the site is business-critical
- Delete plugins and themes you are not using; deactivated is not removed
- Replace any plugin abandoned by its developer for over a year
Lock down logins
- No account named "admin"
- Long, unique passwords via a password manager
- Two-factor authentication on every administrator account
- Limit login attempts to stop brute-force scripts
- Give each person the lowest role that lets them do their job
Harden the installation
- Disable file editing from the dashboard
- Block PHP execution in the uploads folder
- Enforce HTTPS everywhere
- Keep XML-RPC disabled unless something you use genuinely needs it
- Use a security plugin with a firewall and malware scanning
Backups done properly
- 1Daily automated backups of both files and database
- 2Stored off-site, not on the same server as the site
- 3At least 30 days of history, so you can go back past a slow-burning compromise
- 4Restore one to a staging site occasionally — an untested backup is a hope, not a plan
Signs you may already be compromised
- Unexpected redirects, especially only on mobile or only from search results
- Admin accounts you did not create
- Sudden slowdowns or unexplained server load
- Google Search Console security warnings
- Spammy pages appearing in a site: search for your domain
- Files modified at times when nobody was working
If you are hacked
- 1Take the site offline or into maintenance mode to protect visitors
- 2Change every password — WordPress, hosting, FTP, database
- 3Restore from a backup taken before the compromise
- 4Update everything before bringing it back online
- 5Scan thoroughly to confirm nothing was left behind
- 6Request a review in Search Console if Google flagged the site
Cleaning a hacked site costs far more than the maintenance that would have prevented it — and that is before counting the lost enquiries while it was down.
Frequently asked questions
Is WordPress secure?
WordPress core is well maintained and audited. Most compromises come from outdated third-party plugins and weak passwords rather than from WordPress itself.
Do I need a security plugin?
It helps, particularly for firewall rules, login limiting and malware scanning. It is not a substitute for keeping things updated — a security plugin on an outdated site is a lock on an open door.
How often should I update plugins?
Weekly for most sites, and immediately for any update flagged as a security release. Test on staging first if the site is critical to your business.