WordPress is the most widely used website system in the world — which is exactly why it's attackers' favourite target. The good news is that the vast majority of hacked sites are hacked through the same mistakes, and they're not hard to prevent.
Why do updates matter?
WordPress itself, themes and plugins are updated regularly. Some updates bring new features, but an important share close discovered security holes. Once a vulnerability is public, automated scripts scan the internet for sites running old versions. An un-updated site can become a target within days.
Updating safely: step by step
- Backup first. Before updating, make sure you have a fresh copy of the files and database.
- Update one at a time. Update plugins one by one, not all at once. If something breaks, you'll know straight away which plugin caused it.
- Check after updating. Check the home page, forms, the cart and payments (if you have them).
- Be careful with major versions. For a major version change of WordPress or a key plugin, it makes sense to wait a few days and read other users' feedback — but don't hold back small security updates.
Plugins: fewer and trustworthy
- Don't just deactivate plugins and themes you don't use — delete them; a deactivated plugin's files stay on the server and the hole can still be exploited.
- Replace plugins that haven't been updated for a long time and have been abandoned by their author.
- Never download paid plugins and themes from sites offering "free versions": those files often contain malicious code.
Login security
- Drop the "admin" username and give every user their own account.
- Use a strong, unique password and keep it in a password manager.
- Turn on two-step verification (2FA) — the account stays protected even if the password is stolen.
- Give staff only the rights they need: someone who writes articles doesn't need to be an administrator.
- Limit login attempts so bots trying to guess passwords are blocked.
The server side
- An up-to-date PHP version. Old PHP versions get no security updates and slow the site down.
- HTTPS. Every page should open over SSL.
- Daily backups kept separately from the site. More: the 3-2-1 rule.
- Malware scanning. Files should be scanned regularly and suspicious changes spotted quickly.
What we already have in place
Our WordPress hosting plans include daily automatic backups, free SSL and Cloudflare protection, and sites on our hosting are scanned for malware with ImunifyAV+. If you don't have time for updates and checks yourself, choose one of our technical support packages — we'll do the work.
