WordPress powers a huge share of the world's websites — which also makes it the most attacked website platform on the planet. Not because it's uniquely insecure, but because it's uniquely popular: automated bots probe every WordPress site they can find, around the clock, trying default logins, known plugin vulnerabilities, and every trick in the book. The good news is that nearly all successful attacks exploit basics that were never handled — outdated software, weak passwords, and missing hardening. WordPress security isn't mysterious. It's a checklist, and this is it.
These tips are written for UK business owners and the people who look after their sites — practical, in priority order, with the "tricks" (the less-obvious hardening steps) marked clearly. No security theatre, no fear-selling, just what works.
Tip 1: Keep everything updated — core, themes, and plugins
This is the single highest-impact security measure and the most neglected. The majority of hacked WordPress sites are compromised through known vulnerabilities in outdated plugins or themes — flaws that were patched months before the attack, sitting unapplied. Enable automatic updates for minor core releases (on by default in modern WordPress), and set a weekly routine — calendar reminder, not good intentions — to update plugins and themes. Better still, use a managed maintenance arrangement where someone does it for you and checks the site still works afterwards.
Equally important: delete what you don't use. Every inactive plugin and theme is attack surface with zero benefit — deactivated code can still contain exploitable files. Audit quarterly: if a plugin hasn't been used in months, remove it. If a plugin hasn't been updated by its developer in over a year, replace it — abandoned plugins are where zero-days go to live. Fewer plugins, from reputable developers, updated promptly: that's 80% of WordPress security in one sentence.
Tip 2: Lock down logins properly
Brute-force login attacks are constant background noise for every WordPress site — bots trying thousands of username/password combinations against wp-login.php. The defences, in order of effectiveness: enforce strong passwords for all users (and remove accounts for people who've left — stale admin accounts are a classic entry point), never use "admin" as a username, enable two-factor authentication for all administrator accounts (this single step defeats the vast majority of brute-force attacks even if a password leaks), and add login attempt limiting to slow automated attacks.
The trick most sites miss: change the login URL. Moving wp-login.php to a custom address (via a security plugin) doesn't make you invulnerable, but it removes you from the automated spray-and-pray attacks that target the default URL — cutting malicious login traffic dramatically. It's obscurity, not security, but obscurity that filters out 99% of the noise is still worth having as one layer among many.
Tip 3: Harden the server and file layer
A few file-level measures that separate hardened sites from soft targets. Set correct file permissions (folders 755, files 644 — never 777), disable file editing from the WordPress dashboard (so a compromised admin account can't directly inject code into theme files), protect wp-config.php (it holds your database credentials — block direct access to it at server level), and disable XML-RPC if you don't need it (it's a longstanding vector for brute-force amplification and pingback abuse; most modern sites don't use it).
Choose hosting that takes security seriously. Cheap shared hosting where one compromised neighbour site can affect yours is a false economy for a business site. Look for hosts offering server-level firewalls, malware scanning, isolated accounts, and daily backups with easy restore — UK-based hosting also keeps your data under UK jurisdiction, which simplifies your GDPR story. If your site runs on a host chosen purely on price five years ago, the hosting conversation is overdue.
Tip 4: Backups that you can actually restore
Backups aren't a security measure — they're the recovery measure that makes security incidents survivable. The rules: automated, daily at minimum for active sites; stored off-server (a backup on the same server as the site is not a backup); multiple restore points (if the hack happened three weeks ago and you only keep seven days, you're restoring the hack); and tested — actually perform a test restore to a staging environment at least once, because a backup you've never restored is a hope, not a plan.
Know your host's backup policy too: many hosts keep backups, but retention periods and restore fees vary. Your own independent backup (via a reputable plugin or service) means you're not dependent on the host's goodwill at 2am during an incident. After any security event, the ability to roll back to a known-clean state quickly is what turns a disaster into an anecdote.
Tip 5: Use a security plugin — and configure it
A reputable security plugin (Wordfence, Sucuri, Solid Security and similar) adds the layers WordPress core doesn't include: a web application firewall that blocks malicious requests before they reach your site, malware scanning of core files and plugins, login security hardening, and activity auditing that shows you what's happening. Install one — but then configure it. Default settings are a starting point; tune the firewall rules, set up alerting for admin logins and file changes, and review the reports occasionally.
One plugin, well configured, beats three overlapping ones. Stacking multiple security plugins causes conflicts, performance drag, and a false sense of safety. And remember what a plugin can't do: it can't fix an abandoned plugin with a zero-day, it can't make your hosting secure, and it can't update itself into compensating for "password123". Defence in depth means layers, not a magic shield.
Tip 6: The tricks — less-obvious hardening that works
A few measures beyond the basics that punch above their weight. Hide your WordPress version (it tells attackers exactly which vulnerabilities to try — most security plugins do this in one toggle). Disable user enumeration (the ?author=1 trick that reveals usernames — block it at server level or via plugin). Add security headers (Content-Security-Policy, X-Frame-Options and friends — set at server level or via plugin; they blunt entire classes of attack). Separate your admin users' display names from their usernames (attackers need the username; don't hand it to them in author archives). And for WooCommerce or membership sites: make sure customer data exports and API keys are audited — the crown jewels need their own checklist.
For UK businesses specifically: document your security measures. If you hold customer data, your GDPR accountability story should include technical measures — and "we keep WordPress updated, enforce 2FA, back up daily, and run a firewall" is a credible answer. Our WordPress development team builds all of this in as standard on client sites, because retrofitting security is always more expensive than building it in.
What to do if you've been hacked
Stay calm and work the list: take the site offline or into maintenance mode to stop it attacking visitors, change all passwords (hosting, WordPress admins, database, FTP), restore from a known-clean backup if you have one, scan everything if you don't, identify the entry point (outdated plugin is the usual suspect — update or remove it), check for backdoors and rogue admin users, then request Google's malware review in Search Console if you've been flagged. Then do the post-mortem: whatever got you in needs fixing permanently, or it'll happen again. Most hacks are repeat hacks through the same unpatched door.
And be honest with affected customers if their data may have been exposed — UK GDPR has breach notification requirements, and the ICO takes a dim view of cover-ups. Quick, transparent incident handling preserves more trust than silence ever does.
FAQs
Is WordPress secure enough for a business website?
Yes — when maintained. WordPress core is actively maintained by a large security team and is as secure as any mainstream CMS. The insecurity reputation comes from the ecosystem reality: millions of sites running outdated plugins on cheap hosting with weak passwords. A maintained, hardened WordPress site is a perfectly sound business platform. An unmaintained one is a liability regardless of platform.
How often should I update WordPress plugins?
Check weekly at minimum; apply security updates immediately when announced. If weekly manual updates aren't realistic for you, that's exactly what maintenance plans exist for — the cost of a plan is trivial next to the cost of a cleanup and the lost business during downtime. See also our piece on why your business website needs a maintained blog — an unmaintained site undermines the content investment too.
Are free security plugins good enough?
The reputable free tiers (Wordfence free, for example) cover the essentials well for small sites: firewall, scanning, login hardening. Paid tiers add faster threat intelligence, country blocking, and support — worth it for business-critical or ecommerce sites. What's not good enough is no security plugin configured at all.
Does changing the login URL really help?
Against targeted attacks, no — a determined attacker finds it. Against the automated botnets that constitute the overwhelming majority of WordPress attacks, yes, significantly — they spray the default URL. Treat it as noise reduction layered on top of real defences (2FA, strong passwords, updates), never as a substitute for them.
Should I worry about security if my site is small and gets little traffic?
Yes — bots don't check your traffic before attacking. Small, unmaintained sites are actually preferred targets: they're numerous, rarely monitored, and make useful stepping stones for spam and phishing campaigns. Obscurity is not a security strategy.
WordPress security is maintenance, not magic: update promptly, prune ruthlessly, lock down logins, back up properly, and layer your defences. If you'd rather have professionals handle it — hardening, monitoring, updates, and backups done for you — talk to us about looking after your WordPress site.
