WordPress powers a huge slice of the web — roughly four in ten sites worldwide run on it — and that popularity makes it the most targeted platform on the internet. If your business site runs on WordPress, you don't need to be a bank or a household name to attract attackers. Automated bots probe millions of WordPress sites every day looking for outdated plugins, weak passwords and sloppy hosting. For a UK business, the stakes go beyond embarrassment: if customer data leaks, you're dealing with UK GDPR, the ICO and potentially serious fines. The good news is that most WordPress hacks are not sophisticated. They exploit the same handful of basic weaknesses, which means a practical hardening routine stops the vast majority of them. Here's the checklist we actually use.
Why WordPress sites get hacked (it's rarely the core)
WordPress core itself is well maintained and, when kept updated, is rarely the way in. The real culprits are depressingly ordinary. The most common entry points are outdated plugins and themes — abandoned or unpatched extensions with known vulnerabilities — followed by weak or reused login credentials, nulled (pirated) themes and plugins laced with backdoors, and cheap shared hosting where one compromised neighbour can infect your site. A hacked site typically gets used to send spam, host phishing pages, redirect your visitors to scam sites, or mine cryptocurrency. You often won't notice for weeks. That's why the checklist below matters more than any single "security plugin".
The WordPress security checklist
1. Keep everything updated — core, plugins and themes
This is the single highest-impact habit. Enable automatic updates for minor core releases, and update plugins and themes promptly — ideally within days of a release, not months. Before updating a business-critical site, take a backup and, if your host supports it, test major updates on a staging copy first. An update breaking your checkout page for an afternoon is still better than a breach, but staging lets you avoid both. Just as important: delete plugins and themes you're not using, including inactive ones. Inactive code is still code on your server, and abandoned plugins are a favourite way in. Aim for a lean install — every plugin should earn its place.
2. Lock down logins
Brute-force attacks hammer wp-login.php constantly. Make their lives hard:
- Never use "admin" as a username. Create a unique administrator account and delete the default one.
- Use long, unique passwords (a password manager makes this painless) — and never reuse your WordPress password anywhere else.
- Turn on two-factor authentication (2FA) for every administrator account. This alone defeats most credential-stuffing attacks.
- Limit login attempts so repeated failures trigger a temporary block.
- Consider changing the login URL or adding IP restrictions to wp-admin if your team has fixed IP addresses. It won't stop a targeted attack, but it removes you from the automated noise.
3. Backups you can actually restore
Backups are your last line of defence, and most businesses get them wrong. A backup stored on the same server as your site is not a backup — if the server goes, so does it. Follow the rough 3-2-1 principle: multiple copies, on different media, with at least one off-site (cloud storage or a separate provider). Automate daily backups for active sites, keep several weeks of history, and — the part everyone skips — test a restore at least once. A backup you've never restored is a hope, not a plan. If you're storing customer data, make sure your backup provider's data residency works for UK GDPR.
4. Use HTTPS everywhere
An SSL certificate is free (via Let's Encrypt) and takes minutes to set up, yet plenty of business sites still serve mixed content or let certificates lapse. HTTPS encrypts data between your visitors and your server — essential if you take enquiries, bookings or payments — and browsers now flag non-HTTPS pages as "not secure", which quietly kills trust. After enabling SSL, force HTTPS across the whole site and fix mixed-content warnings so every asset loads securely. It's also a minor ranking signal, which doesn't hurt.
5. Choose hosting that takes security seriously
Your host is your foundation. Bargain-basement shared hosting often means hundreds of unrelated sites on one server, outdated server software, and no isolation between accounts — one hacked neighbour can become your problem. For a business site, look for a host that offers server-level firewalls, malware scanning, isolated accounts, daily backups, and support staff who actually understand WordPress. Managed WordPress hosting costs more (£15–£60/month is typical for small business plans) but buys you patched servers, staging environments and experts on call. If your site earns money, this is not the place to economise. For more on the ongoing side of site ownership, see our guide on website maintenance and online sales.
6. Harden the configuration
A few small changes close off easy wins for attackers:
- Disable file editing from the WordPress dashboard (via wp-config.php) so a compromised admin account can't inject code directly.
- Protect wp-config.php — it holds your database credentials. Move it one level above the web root where your host allows, or block access to it at server level.
- Set sensible file permissions (typically 644 for files, 755 for directories; never 777).
- Disable XML-RPC if you don't need it (most sites don't — it was built for the old mobile apps and pingbacks). It's a classic brute-force and DDoS vector.
- Hide your WordPress version and limit what's exposed in page source and REST endpoints where practical.
7. Add a Web Application Firewall (WAF)
A WAF sits in front of your site and filters malicious traffic before it reaches WordPress — blocking known attack patterns, botnets and vulnerability probes. Cloud-based WAFs (such as Cloudflare's free or pro tiers, or Sucuri) also add DDoS protection and can speed up your site via caching. Think of it this way: updates fix known holes, strong logins stop guessing, and a WAF catches the zero-day stuff in between. For a business site, the combination of all three is the standard we'd recommend.
8. Scan, monitor and review users
Install a reputable security plugin for file-integrity monitoring and malware scanning, and set up alerts for admin logins, file changes and failed login spikes. Then actually read the alerts. Also audit your users twice a year: remove old staff accounts, contractor logins and anyone with an administrator role who doesn't need one. Follow the principle of least privilege — editors edit, shop managers manage orders, and only one or two people hold the admin keys. Stale accounts belonging to ex-employees are a depressingly common breach vector.
What to do if your site is already hacked
Don't panic, but act fast. The rough order: take the site offline or into maintenance mode to stop it infecting visitors; change all passwords (hosting, WordPress, database, FTP); restore from a clean backup taken before the infection (this is why backup history matters); or, if no clean backup exists, have a professional clean the site — removing the visible malware isn't enough, backdoors hide in database entries and obscure files; then update everything, reset salts/keys in wp-config.php, and scan again. Afterwards, tell your host, and if personal data was exposed, assess your UK GDPR breach-notification duties — the ICO expects notification within 72 hours where there's risk to individuals. Then find the entry point, or it'll happen again.
How often should you review security?
Security isn't a one-off project. A sensible rhythm for a UK SME: weekly — check updates are applied and backups ran; monthly — review security alerts, scan for malware, check uptime; quarterly — audit user accounts and plugin list, test a backup restore; annually — review hosting, SSL, and whether your setup still fits the business. Put it in someone's calendar with a name attached, or it won't happen. If nobody on your team has the time or inclination, that's exactly what a maintenance plan is for.
If your WordPress site is business-critical and security keeps sliding down the to-do list, our WordPress development team can audit your current setup, harden it properly, and keep it maintained. Get a free consultation and we'll tell you honestly what's at risk and what it'd take to fix it — no scare tactics.
FAQs
How often should I update WordPress plugins?
Promptly — within days of a release for anything security-related. Enable auto-updates for minor releases and trusted plugins, and schedule a weekly manual check for the rest. Abandoned plugins with no updates in over a year should be replaced or removed.
Is a free security plugin enough to protect my site?
A good security plugin helps with monitoring, login protection and scanning, but it's one layer, not a strategy. Updates, backups, strong credentials, decent hosting and a WAF matter more. No plugin fixes an unpatched vulnerability or a weak password.
Do I really need SSL if I don't sell online?
Yes. Browsers label non-HTTPS sites "not secure", which erodes trust even on brochure sites, and any contact or enquiry form transmits data that should be encrypted. Certificates are free via Let's Encrypt, so there's no cost excuse.
What does a hacked WordPress site typically cost a UK business?
It varies wildly: a straightforward cleanup runs a few hundred pounds, but add lost sales during downtime, emergency developer time, SEO damage from Google blacklisting, and potential ICO fines if personal data was breached, and the true cost is often several thousand. Prevention is dramatically cheaper.
Should I move to managed WordPress hosting?
If your site generates revenue or holds customer data, usually yes. Managed hosts handle server patching, daily backups, staging and WordPress-savvy support for roughly £15–£60/month — a reasonable price for removing an entire category of risk from your plate.
