Security
WordPress security: best practices for your site
Most attacks on WordPress sites are automated and exploit common oversights. Learn the habits that close those doors: keeping things updated, using strong passwords with 2FA, being careful with plugins and themes, assigning roles and keeping backups.
HostSpace team
4 min read
Key takeaways
- Update WordPress, plugins, themes and PHP regularly.
- Use unique passwords and two-factor authentication for administrators.
- Install plugins only from trusted sources and delete unused ones.
- Keep backups outside your site and always load over HTTPS.
Article contents
Why small sites get attacked
It is easy to think nobody will bother with a small business website. But most attacks are not personal: they are automated programs that crawl the internet looking for sites with old versions, weak passwords or plugins with known flaws. If your site has one of those open doors, they will find it.
Because WordPress is so popular, it is also a frequent target. The good news is that a few habits close the vast majority of those doors.
What are they after? Rarely your information in particular. Usually they want to use your site to send spam, redirect your visitors to scam pages, hide links to other sites or use your server to attack others. The result for you is the same: customers who lose trust, emails that stop arriving and search engines that may flag your site as dangerous.
Keep everything up to date
Updates don't just add features: many fix security flaws that are already public. An outdated site is an easy target.
The most practical approach is to set a recurring time, for example once a week, to log in to your WordPress dashboard and check what is pending. If nobody on your team does it, put in writing who is responsible; forgotten updates are one of the most common oversights.
- WordPress. Minor updates usually install themselves; make sure major ones don't sit pending.
- Plugins and themes. Check your WordPress dashboard regularly and update whatever is waiting.
- PHP. Use a version that is still supported; you can switch it in cPanel.
Before a major update, have a recent backup. If something breaks, you can go back to how it was. We explain how in website backups.
Passwords and two-factor authentication
Many break-ins start with a guessed password, or one reused from another service. To avoid that:
- Use long, unique passwords for every account; a password manager helps.
- Turn on two-factor authentication (2FA) for administrators. Besides the password, it asks for a code from an app on your phone.
- Avoid “admin” as a username.
- Limit login attempts with a trusted security plugin.
Don't forget to protect your hosting panel and your email too: if someone gets in there, they can reach your site another way.
Plugins and themes: less is more
Every plugin and theme you install is code someone else wrote, running on your site. The more you have, the more chances one of them has a flaw.
Before installing a new one, check when it was last updated, what other users say about it and whether it supports your WordPress version. If the feature you want is simple, ask yourself whether you really need a plugin for it.
- Download only from trusted sources: the official WordPress directory or the developer's own site.
- Never install free “premium” versions from unofficial sites; it is a common way to slip in malicious code.
- Delete what you don't use. A deactivated plugin is still on the server; if you don't need it, remove it. The same goes for themes.
- Check that they are maintained. If a plugin hasn't been updated in a long time, look for an alternative.
User roles
Not everyone who works on your site needs to be an administrator. WordPress has roles with different permissions; give each person the minimum they need to do their job.
| Role | What it can do |
|---|---|
| Administrator | Full control of the site. Only for whoever actually runs it. |
| Editor | Publishes and edits anyone’s content. Useful for whoever manages the blog. |
| Author | Publishes and edits only their own posts. |
| Contributor | Writes posts, but someone else has to approve them. |
When someone stops working with you, delete their account or change their role. Forgotten accounts are an easy way in.
The same goes for agencies or freelancers who helped you at some point: if they no longer work on your site, remove their access. If they need to come back, create a temporary account with just the role required for that task.
Backups and SSL
No measure is foolproof, so you need a plan B: frequent backups stored outside your site, and knowing how to restore them. If something goes wrong, a backup lets you go back to a safe point.
Some signs that something is wrong and your site needs a check:
- Administrator users appear that you didn't create.
- Your site redirects to pages you don't recognize, especially on mobile.
- Google or your browser shows a warning when you visit it.
- Your provider tells you your account is sending bulk email.
Your site should also always load over HTTPS. The SSL certificate encrypts information between the visitor and your site, including passwords when logging in. If you have questions, read what an SSL certificate is.
Frequently asked questions
It can help limit login attempts and alert you to suspicious changes, but it does not replace updates, strong passwords or backups.
No. A deactivated plugin is still on the server and can have flaws. If you do not need it, delete it.
Change the passwords for your site, hosting panel and email, and contact your provider. If you have a clean backup, restoring it is usually the safest path.
HostSpace team
We provide hosting, domains, VPS servers and business email with Spanish-speaking support. We write about what our customers ask us most.