WordPress runs a large share of business websites, which also makes it a large, well-studied target. Most successful attacks on WordPress sites exploit outdated software or weak credentials — not sophisticated vulnerabilities.
The core checklist
- WordPress core, theme, and all plugins kept up to date, with outdated or unused plugins removed entirely
- Strong, unique admin credentials with multi-factor authentication enabled
- A reputable security plugin or service handling basic firewall and malware scanning
- Login attempts limited or throttled to prevent automated password-guessing
- Regular, tested backups stored away from the website's own server
Plugins are the most common weak point
Every additional plugin is additional code that can contain a vulnerability, and abandoned plugins — ones no longer updated by their developer — are a particularly common entry point. A useful habit is periodically reviewing installed plugins and removing anything that isn't actively used, rather than letting them accumulate over the site's lifetime.
What to do if a website is compromised
If a website shows signs of compromise — unexpected content, search engine warnings, unfamiliar admin accounts — the priority order is: isolate the site (take it offline or restrict access), restore from a known-clean backup rather than trying to manually clean an active infection, change all credentials, and only then investigate how the breach occurred so it isn't repeated.
Common Mistakes to Avoid
- Running outdated plugins because an update might 'break something'
- Using 'admin' or a predictable username as the primary login
- Trying to manually clean a compromised site instead of restoring a clean backup
- Never checking who still has admin-level access to the site
WordPress security is largely maintenance discipline rather than a one-time configuration — the checklist above is worth revisiting on a regular schedule, not just at launch.