Option 1: Do it yourself
Follow the steps in this guide. Free, and typically 30 minutes to a few hours of careful work.
Option 2: Just contact us
Skip every step below. $49/mo and it is sorted, or WhatsApp us right now.
Last updated: August 2026
The five that matter most
1. Update everything, promptly. The majority of compromised WordPress sites were running known-vulnerable plugin or theme versions. Every security release is also a public description of what to attack on sites that have not applied it.
2. Strong unique passwords plus two-factor. Credential reuse and weak passwords are the second great entry point. Use a password manager the business owns, and enable two-factor for every administrator.
3. Fewer administrators. Most people who "need access" need Editor, not Administrator. Audit your user list twice a year and remove everyone who has left. Every admin account is a key to the building.
4. A firewall. Wordfence, Sucuri or a Cloudflare WAF filters malicious traffic before it reaches your code and blocks the automated scanning that finds vulnerable sites in the first place.
5. Verified off-site backups. Not strictly prevention, but the difference between an incident and a catastrophe. Details in our backup guide.
The next ten, in order
6. Delete what you do not use. Inactive plugins and themes are still code on your server, still exploitable, and frequently unpatched.
7. Never install nulled or pirated themes and plugins. They arrive with malware pre-installed. This is not a risk, it is the business model.
8. Keep PHP current. End-of-life PHP versions stop receiving security patches entirely.
9. Harden the login page. Limit login attempts, and consider a custom login URL to cut automated brute-force noise.
10. Disable file editing in the dashboard. Add define('DISALLOW_FILE_EDIT', true); to wp-config.php so a compromised admin account cannot rewrite your code from the browser.
11. Block PHP execution in the uploads folder. Uploads should hold media, never executable code; this one rule blocks a whole family of attacks.
12. Use SSL everywhere and fix mixed content. Also monitor expiry, since expired certificates break trust instantly.
13. Set correct file permissions. Typically 644 for files and 755 for directories, and never 777 on anything.
14. Run malware scanning on a schedule. Detection speed decides whether an infection is a cleanup or a Google blacklisting.
15. Monitor and log. Uptime, file integrity and blacklist monitoring turn silent problems into alerts you can act on within minutes.
Security is a routine, not a project
Every item above decays. New plugins arrive, staff leave with access, PHP versions age out, firewalls need tuning. A site hardened perfectly in January is meaningfully weaker by June with no changes at all. That maintenance rhythm, monthly, is exactly what our plans exist to hold, and it is the difference between a checklist you completed once and a site that stays secure.
FAQ
Is WordPress insecure? No. WordPress core is well maintained; the vast majority of compromises come from outdated third-party plugins, weak credentials and abandoned code, all of which are maintenance failures rather than platform failures.
Do I need a paid security plugin? Free tiers of good plugins cover the basics well. Paid tiers add faster malware signatures and cleanup support, which matter more for stores and high-traffic sites.
My site is small. Why would anyone attack it? Nobody chose you. Bots scan the entire internet for known vulnerabilities, and small sites are attacked constantly precisely because they are usually unmaintained.
What is the single most common entry point? An outdated plugin. It has been the answer for a decade and it still is.
You do not have to do any of this yourself
Skip the steps above. Our engineers handle security, updates, speed, backups and fixes for you, with a 12-minute average response and a 99.99% uptime target.