The WordPress security best practices that protect most business sites are not exotic: keep WordPress, plugins and themes updated, remove what you do not use, give every person their own account with only the access they need, use strong passwords with two-factor sign-in, keep backups somewhere other than the server, and know exactly who has admin access. A security plugin helps, but it cannot make up for skipping those basics.
Most hacked sites I have seen were not hit by anything clever. Here is the checklist I use, and the most unsettling thing I ever found on a client’s site.
The kill switch
When Thailand Mountain Trail brought me in, their site ran on a heavily tweaked theme built by a previous developer. Looking through it, I found a security hole, a hidden administrator account, and a plugin whose only job was to switch the site off on command. The business did not know any of it was there.
I removed all of it, closed the hole, handed full control back to the client and then rebuilt the site properly. The story is in the Thailand Mountain Trail case study. It is the reason the first item on my checklist is about people, not software.
1. Know who has access
- List every user account with the Administrator role. If you cannot name the person behind each one, remove it or downgrade it.
- Give everyone their own login. Shared admin accounts make it impossible to know who did what.
- Use the lowest role that does the job. Someone who writes posts does not need to install plugins.
- Remove access when people leave, including past developers and agencies. Their accounts should not outlive the project.
- Check your hosting and domain accounts too. The site is only as safe as the logins that control it.
2. Update everything, and remove what you do not use
Most attacks go after known holes in outdated plugins and themes. Turn on updates, or have someone apply them weekly. Delete plugins and themes you are not using, because a deactivated plugin can still be a way in if its files are on the server.
Be wary of nulled or pirated premium plugins. “Free” copies of paid plugins are a common way malware gets onto sites.
3. Strong sign-in
- Long, unique passwords from a password manager.
- Two-factor authentication for every account that can change the site.
- Limits on repeated login attempts.
These three stop most automated attacks on their own.
4. Backups you can actually restore
Keep automatic daily backups of the files and the database, store them somewhere other than your web server, and keep several days of history. Then test a restore at least once. A backup you have never restored is a hope, not a plan. The official WordPress backup guide covers the options.
5. Harden the basics
The WordPress hardening guide is the reference. The items I check on every site:
- HTTPS everywhere, with no mixed content.
- File editing from the dashboard turned off.
- Sensible file permissions on the server.
- Up-to-date PHP from a host that patches its servers.
- A web application firewall at the host or in front of the site.
6. Custom code has to be secure too
Plugins and snippets written for your site deserve the same scrutiny as anything you download. Every form, every setting and every admin screen needs permission checks, validated input and escaped output. WordPress publishes clear plugin security guidelines, and the OWASP Top Ten lists the most common web application risks.
When a plugin handles sensitive data, the bar goes up. The hiring system I built for a police department uses custom roles so only the right staff see applicant data, encrypts sensitive fields and keeps an audit log of every action. I describe it in taking police recruitment off paper.
7. Watch for trouble
- Get alerts for new admin accounts and plugin changes.
- Check Google Search Console for security warnings.
- Look at what changed whenever the site behaves strangely, instead of only reinstalling.
Is a security plugin enough?
A good security plugin adds a firewall, login protection and scanning, and many sites should run one. But it cannot remove a hidden admin account it was never told to look for, fix a plugin you never update, or restore a site with no backup. Security is a set of habits, which is why my Plugin Stack page puts it plainly: security is not a plugin.
Every plugin I build comes with security updates for free, for as long as I maintain it. If you are hiring a developer, ask them about this. It is one of the questions in 12 questions to ask before you hire a WordPress developer.
Frequently asked questions
How do I know if my WordPress site has been hacked?
Common signs are unknown admin users, spam pages in Google’s results for your domain, redirects to other sites, warnings in Search Console or your browser, and files changed that nobody touched. If you see any of them, restore from a clean backup and find how they got in.
Can a developer leave a back door in my website?
Yes, and it happens. Audit admin accounts when a project ends, remove developers’ access you no longer need, and have someone you trust review the code on a site you inherit.
How often should WordPress be updated?
Security updates should go in as soon as they are released. Regular updates can be applied weekly, after a backup, and checked on a staging copy for larger sites.
