Outdated plugins are how sites get hacked
Not sophisticated attacks. An automated scan finds a known vulnerability in a plugin that has not been updated for eight months.
Updating within days of a security release prevents the large majority of WordPress compromises. Everything else is secondary to that.
The four that matter
- Update core, themes and plugins promptly — weekly at worst
- Delete anything unused, including deactivated plugins and old themes
- Strong unique passwords with two-factor on every admin account
- Backups that are tested, stored off the server, and restorable
Account hygiene
- No account called admin
- Editor role for people who edit, not administrator
- Remove accounts for people who have left, the day they leave
- Review the user list quarterly — there is usually a surprise
Worth doing beyond the basics
| Measure | Value |
|---|---|
| A web application firewall | High — blocks known attacks before they land |
| Disabling file editing in the admin | High — one line, removes a common attack path |
| Limiting login attempts | Medium |
| Hiding the login URL | Low — obscurity, not security |
| Changing the database prefix | Low, and disruptive to change later |
Test the backup
A backup you have never restored is a hope. Restore one to a staging site once, and you will know whether it works.
That test finds problems — missing database, incomplete files, broken permissions — at a time when they cost nothing.