WordPress
The Security Work That Actually Matters
Last updated:
Outdated plugins are how sites get hacked
Not sophisticated attacks. An automated scan finds a known vulnerability in a plugin that has not been updated for eight months.
Updating within days of a security release prevents the large majority of WordPress compromises. Everything else is secondary to that.
The four that matter
- Update core, themes and plugins promptly — weekly at worst
- Delete anything unused, including deactivated plugins and old themes
- Strong unique passwords with two-factor on every admin account
- Backups that are tested, stored off the server, and restorable
Account hygiene
- No account called admin
- Editor role for people who edit, not administrator
- Remove accounts for people who have left, the day they leave
- Review the user list quarterly — there is usually a surprise
Worth doing beyond the basics
| Measure | Value |
|---|---|
| A web application firewall | High — blocks known attacks before they land |
| Disabling file editing in the admin | High — one line, removes a common attack path |
| Limiting login attempts | Medium |
| Hiding the login URL | Low — obscurity, not security |
| Changing the database prefix | Low, and disruptive to change later |
Test the backup
A backup you have never restored is a hope. Restore one to a staging site once, and you will know whether it works.
That test finds problems — missing database, incomplete files, broken permissions — at a time when they cost nothing.
Frequently asked questions
Do we need a security plugin?
A firewall plugin adds real value. Do not let it substitute for updating, which is what actually prevents compromise.
How often should we update?
Weekly at minimum, and within days for security releases. Use staging for major updates.
What if we get hacked?
Restore from a clean backup, update everything, change all passwords, and find how they got in — otherwise it recurs.
Is managed hosting worth it for security?
Frequently yes. Good hosts handle updates, firewalling and backups, which removes the most common failure: nobody doing it.
Not sure when your site was last updated?
That is usually the answer to how secure it is. Happy to check it over.