Nobody is sitting in a dark room deciding to hack your plumbing website. Attacks on small business WordPress sites are almost entirely automated: bots scan millions of sites for a known hole in an out-of-date plugin, or try common passwords against login pages, and they get in wherever the door is open. That’s good news. It means you don’t need to outsmart a person. You need to not be the easy one.
Below is what we do on the sites we manage, in the order that gives you the most protection for the least effort. If you only get through the first four, you’ve dealt with the large majority of what we see go wrong.
1. Keep everything updated
Time: 15 to 30 minutes a fortnight, or covered by a maintenance plan.
In our experience, an out-of-date plugin is the usual way in. When a security hole in a popular plugin is published, bots start probing for it within days, sometimes hours. Sites that updated are fine. Sites that didn’t are the ones that get hit.
That covers WordPress core, every plugin, your theme, and the PHP version on your server. It also means deleting plugins and themes you don’t use. A deactivated plugin is still sitting on your server, and some vulnerabilities can be reached even when it’s switched off.
Updating safely is its own topic (backup first, sensible order, check the site afterwards), and we’ve written it up in WordPress updates: core, plugins and themes in the right order.
2. Lock down logins
Time: about an hour to set up, then nothing.
The second biggest problem is weak or reused passwords. If the password for your WordPress admin is the same one you used on a site that leaked years ago, it’s probably already on a list that bots are working through.
Do these three things:
- Use a password manager and give every WordPress account a long, unique, generated password. Bitwarden, 1Password and the managers built into Apple and Google devices are all far better than anything you’ll remember.
- Turn on two-factor login for every account that can change the site. WordPress doesn’t include it out of the box. A plugin such as Two Factor adds it, with authenticator app codes and backup codes. Many security plugins include it too.
- Limit failed login attempts. After a handful of wrong passwords, block that IP address for a while. This stops the brute-force bots that hammer your login page all day. Most security plugins and many hosts do this.
Don’t bother renaming the “admin” username on an old site as your main defence, or hiding the login page behind a secret URL. Neither hurts, but a strong password plus two-factor makes them largely irrelevant.
3. Give people only the access they need
Time: 20 minutes, plus a check whenever staff change.
Every Administrator account is a full set of keys. If your office manager only updates the team page and writes the odd blog post, they should be an Editor. Your SEO contractor rarely needs to be an Administrator either.
Open Users in your dashboard now and look at who’s there. Remove anyone who has left, including past developers and agencies. Downgrade anyone with more access than their job needs. The detail on each role is in WordPress user roles: the access people need, no more.
While you’re in there, check each user’s profile for Application Passwords. These are separate passwords that let other tools (apps, integrations, some plugins) log in to your site. WordPress’s own application passwords documentation explains how they work. If there are ones nobody recognises, revoke them.
4. Have backups that live somewhere else
Time: an hour to set up properly, then a restore test every few months.
Backups don’t stop a hack, but they turn a disaster into an inconvenience. The rule is simple: a backup kept on the same server as your website isn’t a backup. If the server is compromised or the hosting account is closed, the backup goes with it.
You want automated backups of the files and the database, stored offsite, with several weeks of copies kept (a hack can go unnoticed for a while, so last night’s copy may already be infected). We set this out properly in what a good WordPress backup looks like.
5. Choose hosting that does some of the work
Time: a decision you make once.
Cheap hosting is a false economy, and security is where it shows. A good host keeps the server software current, offers recent PHP versions, isolates each account so a hacked neighbour can’t reach your site, runs a firewall and malware scanning at the server level, and keeps its own backups. Bargain shared hosting often does few of these, or charges extra for each.
Ask any host these questions before you sign up:
- Which PHP versions do you support, and how much notice do you give before retiring old ones?
- Are accounts isolated from each other on shared servers?
- Do you run a web application firewall and malware scanning?
- Do you take offsite backups, how often, and how long do you keep them?
- If my site is hacked, what do you do and what does it cost?
If you get vague answers, keep looking.
6. Add a security plugin, configured properly
Time: 30 minutes.
A security plugin earns its place mainly through login protection (two-factor, failed login limits) and alerts when core files change. It’s not a replacement for steps 1 to 5. We cover what we look for in the WordPress plugins we install on almost every site.
The common mistake is running two security plugins, or a plugin with a firewall on top of a host that already has one. They interfere with each other, slow the site down, and sometimes lock out the owner. Pick one and set it up deliberately.
7. The smaller hardening steps
Time: 30 minutes for someone comfortable with hosting settings.
These are worth doing, but only after everything above:
- Make sure the whole site runs on HTTPS with a valid certificate (most hosts provide one free)
- Turn off the built-in file editor in the dashboard, so a stolen login can’t be used to edit plugin code directly
- Set sensible file permissions on the server
- Keep the wp-config.php file protected and use unique security keys
The official Hardening WordPress guide covers these in detail for whoever looks after your hosting. You don’t need to understand all of it. You do need to know someone has done it.
What doesn’t help as much as you’d think
A few things get a lot of attention for little benefit. Hiding which version of WordPress you run won’t stop bots, which simply try the exploit anyway. Security badges on your footer don’t stop anything. And an “unhackable” promise from any plugin or host is a sales line, not a guarantee.
The other trap is assuming security is done once. It’s a routine. A site that was secure at launch and hasn’t been touched in two years is no longer secure.
Your security check, this week
If you do nothing else, work through this list once:
- Every plugin, theme and WordPress itself updated
- Unused plugins and themes deleted
- Every admin account has a unique password from a password manager
- Two-factor login turned on for Administrators and Editors
- Old users and unknown application passwords removed
- You know where your offsite backups are and when the last one ran
- You know who to call if the site is hacked, and what it costs
If something does go wrong, your WordPress site has been hacked: the first hour walks through what to do in order.
We host and look after websites for more than 100 clients, and our hosting and care plans page explains how that works. Prefer to keep running it yourself? A one-off check of your logins, backups and plugin list is a standard WordPress fix job, and you can book it here.