Basic Security Measures for Your WordPress Website

“Why would anyone hack my website? I run a flooring company, not a bank.” We hear a version of this from almost every small business owner we talk to, and it rests on a reasonable assumption: that hacking is something a person does to a target they chose. Here’s the uncomfortable truth — nobody chose you. The overwhelming majority of attacks on small business websites are carried out by automated programs that scan enormous numbers of sites every day looking for known weaknesses, the way a car thief walks a parking lot pulling door handles. Your site isn’t targeted; it’s tried. And that’s oddly good news, because it means you don’t need to outsmart a determined criminal. You just need to not be the unlocked car.

Why WordPress sites get attacked

WordPress powers more of the web than any other platform, and that popularity cuts both ways. When a security flaw is discovered in a popular plugin, attackers know that same flaw now exists on hundreds of thousands of sites at once — so they write a bot to find and exploit every one of them, automatically, often within days of the flaw becoming public. And the payoff usually isn’t your data specifically. Hacked small business sites get quietly used to send spam, host phishing pages, redirect your visitors to scam sites, or inflate someone else’s search rankings — sometimes for weeks before the owner notices anything. The damage arrives later: browser warnings that scare customers away, your emails landing in spam folders, and a cleanup bill.

The doors attackers actually come through

Forget Hollywood hacking. Three thoroughly mundane paths account for most compromised WordPress sites:

• Outdated plugins and themes. This is the big one. Every plugin is software, all software has bugs, and updates exist largely to patch security holes. A site running last year’s versions is effectively advertising which holes it still has open.
• Weak or reused passwords. Bots hammer WordPress login pages around the clock with lists of common passwords and credentials leaked from other companies’ breaches. If you use the same password on your website that you used on some forum that got breached years ago, that password is already on a list.
• “Nulled” themes and plugins. Free downloads of paid themes from shady sites are one of the most reliable ways to hack yourself — a large share come with malicious code already baked in. The $60 you save can cost you the entire site.

The defense against all of this is layered — no single measure does the job alone, but each layer is genuinely simple, and together they take you out of the “unlocked car” category entirely.

Keep everything updated — core, themes, and plugins

This is the single highest-value habit in WordPress security, because it closes the door bots check first. Put a recurring fifteen-minute slot on your calendar to run updates, enable automatic updates for minor WordPress releases, and — this one surprises people — delete deactivated plugins entirely rather than leaving them switched off. Deactivated code still sits on your server, and vulnerable code doesn’t need to be “on” to be exploited in some cases. If updating makes you nervous because something might break, that anxiety is usually a backup problem in disguise; we’ll get to that in a moment.

Strong passwords, a password manager, and 2FA

The fix for weak and reused passwords isn’t discipline — it’s a password manager that generates and remembers a long, unique password for every account. Then add two-factor authentication (2FA), which requires a code from your phone alongside the password, so even a stolen password isn’t enough on its own. Do this for your WordPress admin, and don’t stop there: your hosting account and the email address tied to it are actually bigger prizes, because whoever controls those controls everything, password resets included.

Limit login attempts

Out of the box, WordPress will let a bot guess passwords all day, every day, forever. Limiting failed login attempts — locking an address out after a handful of wrong guesses — turns an automated battering ram into a minor annoyance. This isn’t built into WordPress, but nearly every security plugin includes it, and it’s one of the cheapest wins available.

Give people the least access they need

WordPress has user roles for a reason. The person who writes your blog posts needs to be an Editor, not an Administrator; someone who only drafts content can be an Author. Every unnecessary admin account is another set of keys that can be stolen, so audit your users occasionally and remove accounts for anyone who no longer works with you — old contractor logins are a classic way back in. If roles are new territory, our beginner’s guide to the WordPress admin screen walks through where all of this lives.

Backups you’ve actually tested

Here’s a hard truth: a backup you’ve never restored is a hope, not a plan. Plenty of owners discover during an emergency that their backups were incomplete, corrupted, or stored on the same server that just got compromised. Three rules make backups real: they run automatically on a schedule, they’re stored somewhere off your server (cloud storage counts), and you’ve done at least one test restore so you know the process works and how long it takes. As a bonus, trustworthy backups make updates stress-free — the worst case becomes “roll back and try again.”

SSL — table stakes, but check it

SSL is the certificate that encrypts traffic between your visitors and your site and puts the padlock in the browser bar. Any decent host includes it free, browsers actively warn visitors away from sites without it, and there’s no excuse to be missing it in 2026. If any page of your site still loads over plain “http,” fix that this week.

Add a security plugin — one, not three

A good security plugin bundles several of these layers — malware scanning, login protection, alerts when something changes — into one dashboard. Popular security plugins like Wordfence, Sucuri, or Solid Security are great options to consider for your website — we compare all three honestly in our roundup of the top WordPress security plugins. One note of caution: install exactly one. Multiple security plugins fight over the same jobs, and the overlap causes more problems than it prevents.

If you think you’ve been hacked

Common signs: your site redirects visitors somewhere strange, Google results for your business show spammy pages you never wrote, browsers throw a red warning before your homepage, or an administrator account appears that you don’t recognize. If that happens, don’t panic-delete things. Change your passwords — hosting, WordPress, and email — from a device you trust. Contact your host, who can often confirm the compromise and its timing. If you know roughly when it happened and have clean backups, restore to a point before the breach, then immediately update everything and change all passwords again, since restoring also restores the original hole. And if any of that is beyond your comfort zone, professional cleanup is a well-established service — getting help early is almost always faster and cheaper than a week of trial and error while customers see a warning screen.

You don’t have to do this alone

Everything above is doable by a motivated owner, but it does have to actually get done — every month, forever. If you’d rather it just be handled, security monitoring, updates, and tested backups are core parts of GlossyDev’s WordPress care plans, and our Website Analysis & Consult includes a security check with a prioritized list of fixes ranked by risk. Get in touch — a half-hour conversation now beats a cleanup project later.