WordPress runs a large share of the web, which makes it a favourite target. Most attacks are automated scripts looking for easy wins, not people targeting your business. Close the easy wins and you drop out of reach of most of them.
Work through this checklist. You can do many of the points yourself in an afternoon, and our free scanner can check several of them from outside.
1. Keep everything updated
WordPress core, themes and plugins release security fixes constantly. Outdated plugins are the most common way sites are hacked. Turn on automatic updates for security releases, and check weekly for the rest.
2. Delete what you do not use
Every inactive plugin and theme is code that can still be attacked. Delete them, do not just deactivate. Do the same for old user accounts.
3. Use strong, unique passwords
Every admin and editor needs a long, unique password in a password manager. Never reuse a password from another service.
4. Turn on two-factor login
Even a stolen password then fails. Add two-factor authentication for every user who can edit content or settings.
5. Do not use "admin" as a username
Attackers try "admin" first. Create a new administrator with a different name, then remove the old one.
6. Limit login attempts
Automated scripts guess passwords thousands of times. Limit failed attempts and temporarily block repeated offenders.
7. Use HTTPS everywhere
Install an SSL certificate and redirect all http:// traffic to https://. Check that no images or scripts still load over plain http, which causes "not secure" warnings.
8. Add security headers
Headers such as HSTS, Content Security Policy, X-Frame-Options and X-Content-Type-Options tell browsers to apply extra protection. They are free and strongly improve your site's defences. The scanner shows which ones you are missing.
9. Back up daily, off-site, and test it
When all else fails, a clean backup is your way out. Follow our backup guide, keep one copy away from your web server, and test a restore regularly.
10. Hide your versions
Your site should not announce which WordPress, PHP or server version it runs. Hiding them will not save an unpatched site, but it stops attackers from instantly finding your known weaknesses.
11. Lock down file permissions and the editor
Turn off the built-in file editor in the WordPress dashboard so a stolen admin login cannot rewrite your code. Check that web users cannot write to core folders.
12. Monitor and scan
Without monitoring, you find out about an attack from a customer. Use uptime monitoring and regular malware scans so problems reach you first.
Extra for shops and sites with personal data
- A web application firewall
- Regular security reviews
- Separate admin accounts with the minimum permissions each person needs
- A clear privacy policy and secure forms
How you will know it is working
Run the checks again every quarter. If your site scores well on the free scanner and your backups restore cleanly, you are ahead of most small business sites.
Do not have the time or the technical confidence? Our security and care service does this for you every month. And if something has already gone wrong, visit our emergency page.
