Most WordPress hacks do not come from brilliant attackers. They come from neglected basics: an outdated plugin, a weak admin password, or a backup that was never tested. Security for a business site is therefore mostly a routine, and this checklist covers the habits that prevent the vast majority of incidents. Work through it once, then repeat the key items on a schedule.
Keep everything updated, on purpose
Core, themes and plugins should be updated promptly, with a backup taken first. Outdated software is the most common entry point, so set a weekly update slot rather than waiting for a warning. Remove plugins and themes you no longer use, including deactivated ones, since they still present attack surface. Favour plugins with recent updates, a solid user base and a clear support history over obscure alternatives.
Lock down logins
Use a long, unique password for every admin account, enable two-factor authentication, and give each person their own account instead of sharing one admin login. Limit login attempts, change the default admin username if you still use it, and review user accounts regularly: former staff and old test accounts should not keep access. These steps cost minutes and block the automated password-guessing traffic that hits every WordPress site daily.
Backups you have actually tested
A backup you have never restored is a hope, not a plan. Keep automated backups off the server itself, retain several weeks of history, and restore one to a test location at least once so you know the process works. Backups also protect against non-security disasters: a bad update, a deleted page or a hosting failure. Document where backups live and who can restore them.
Hosting and monitoring basics
Choose hosting with server-level firewalls, malware scanning and SSL included, and add a reputable security plugin for file-change alerts and login monitoring. Keep an eye on Search Console and your site's uptime, since defacement or spam injection often shows up there first. If something does go wrong, act fast: take the site offline if needed, restore from a clean backup, change all passwords, and find the entry point before relaunching.
Want help putting this into practice for your own business? Get in touch and tell me about your project — I will give you a straight answer on the best next step.
