WordPress website security: 9-step checklist for your website

WordPress website security is a topic that many site owners only take seriously when it is too late. WordPress is very beginner-friendly and easy to learn – and that is exactly why security is often forgotten. In this article we show how secure WordPress really is, where the typical weak points lie and how you can protect your website effectively with a 9-step checklist.

Creating your own WordPress website is exciting and challenging at the same time: choosing a theme, creating pages, writing content. Security easily gets lost in the process. Attackers take advantage of this. They search automatically for vulnerable websites in order to get hold of sensitive data, spread spam or deliver malware to unsuspecting visitors.

How secure is WordPress?

WordPress is the most widely used content management system in the world. This popularity makes it an attractive target: anyone who finds a vulnerability in a popular plugin can use it to attack many websites at once. Does that mean WordPress is insecure? No.

With the right knowledge, WordPress is at least as secure as a custom-coded website – often even more secure. There is no such thing as a completely unassailable website. But if you develop a website from scratch yourself, you are on your own when it comes to security. WordPress site owners, on the other hand, benefit from a large community that finds, reports and closes security holes.

Is an open-source product really secure?

WordPress is open source: the code is publicly visible – including to attackers looking for weak points. At the same time, however, the official WordPress security team, volunteer developers, security researchers and so-called white-hat hackers also review the code. If a bug slips through, it is usually discovered quickly and fixed with an update.

A custom solution, by contrast, would have to be maintained permanently by you or a security engineer – which is time-consuming and expensive.

Why WordPress websites get hacked

Most security incidents are not caused by a vulnerability in an up-to-date WordPress installation. Typical causes are:

• outdated plugins, themes or WordPress versions
• plugins and themes from dubious sources (“nulled” versions with built-in malware)
• weak or reused passwords
• insecure or poorly maintained hosting
• too many users with administrator rights

The good news: if you follow proven practices, you close most of the gateways. The following checklist shows what matters.

WordPress website security: 9-step checklist

1. Choose secure hosting

A key factor behind many security vulnerabilities is low-quality hosting. If you cut costs on hosting, you often cut corners on security. Before choosing, check whether the provider takes security seriously and uses up-to-date technology. With cheap shared hosting you share the server with many other customers; if the separation of accounts is poorly implemented, one infected website can endanger others. Look out for:

• up-to-date server software: a currently supported PHP 8 version as well as maintained database and operating system versions
• malware monitoring and removal: active detection of infections and clear rules on what happens in an emergency
• firewalls and protective measures: web application firewall, protection against brute-force attacks and DDoS defence
• automatic backups: stored separately from the web server

For business websites and shops, managed hosting is worthwhile, where servers, updates and monitoring are looked after professionally. You can also find an overview of packages under hosting Vienna.

2. Install an SSL certificate

An SSL certificate (technically TLS today) encrypts the data between visitor and website. Your website can then be reached via https, and browsers no longer display a “Not secure” notice. Without SSL, modern browsers clearly warn against your site – and for contact forms and shops HTTPS is mandatory anyway.

The switch takes place in four steps:

1. Get a certificate: Most hosting providers offer free certificates via Let’s Encrypt, which are activated in the hosting panel.
2. Activate SSL in WordPress: switch the WordPress and site address to https, for example with the help of a plugin such as Really Simple Security.
3. Redirect all requests to https: via a 301 redirect, so that nobody calls up the insecure http version any more. Internal links, images and scripts must also point to https.
4. Enforce SSL: security headers such as HSTS ensure that browsers only load your website in encrypted form.

3. Protect your website with backups

Before you make changes, update WordPress or install a plugin, backups should be set up. Whatever happens – an accidental code change, a faulty update or a corrupted database – with a current backup the website can be restored quickly. Even after a hack, you do not have to start from scratch.

Manual backups are free, but time-consuming and easily forgotten. Check whether your host offers automatic daily backups of files and database. External copies in a different storage location are also recommended.

WordPress backup plugins

If your host does not offer complete backups, plugins can help. Proven solutions include UpdraftPlus, BackWPup or Jetpack VaultPress Backup. They automatically save backups to external storage such as cloud services. Important: test the restore every now and then – a backup that cannot be restored is worthless.

A backup plugin does not replace a security plugin. Do not wait until it is too late: setting up security at the last minute is like repairing the roof during a thunderstorm. One hour of setup can save you weeks of work.

4. Keep WordPress, plugins and themes up to date

An outdated plugin or an insecure theme is one of the biggest gateways. Updates close known vulnerabilities. In the dashboard under “Dashboard → Updates” you can see all available updates for WordPress, plugins and themes. Anyone who regularly ignores these notices takes an unnecessary risk.

Even more important than plugin updates is an up-to-date WordPress core. Sometimes an update has to be postponed because a plugin is not yet compatible – in that case you should look for an alternative in the long term rather than leaving WordPress outdated for months. Premium themes from third-party providers do not always deliver automatic updates; check their websites regularly.

Pro tip: Back up your website before every update and then test the most important functions such as forms and checkout.

5. Remove anything unnecessary

Every installed plugin and theme is potential attack code – even if it is deactivated. Delete everything you do not use. Only install extensions from trustworthy sources such as the official directory on wordpress.org or directly from the developer.

By default, WordPress outputs the version number in the source code. Hiding it makes the job harder for automated scanners; many security and performance plugins do this with one click.

6. Secure the login

• strong, unique passwords and a password manager
• two-factor authentication for all administrators
• limiting failed login attempts
• no username “admin”

7. Assign user rights sparingly

Not everyone needs administrator rights. Editors, authors and external service providers only receive the role they need for their task. Remove accounts of former employees and agencies immediately.

8. Use a firewall and a security plugin

A security plugin such as Wordfence or Solid Security offers a firewall, malware scan, login protection and notifications of suspicious changes. In addition, a web application firewall at server or DNS level can intercept malicious requests before they reach your website.

9. Harden the configuration and monitor continuously

Technical hardening includes correct file permissions, disabling the file editor in the back end, protected configuration files and secure security headers. A detailed guide is provided by the official WordPress documentation on Hardening WordPress. Monitoring is just as important: uptime monitoring, malware scans and a look at Google Search Console reveal problems early on.

What a WordPress security plugin can do – and what it cannot

A WordPress security plugin is an important building block, but not all-round protection. It recognises known attack patterns, blocks suspicious requests, reports changed files and protects the login. It performs these tasks reliably as long as it is correctly configured and up to date.

What a plugin cannot do, however:

• automatically make outdated plugins and themes secure – that requires updates
• compensate for weak passwords or administrator rights that have been granted too generously
• fix server weaknesses if the hosting is outdated or poorly secured
• restore a website if no working backup exists

On top of that, running several security plugins at the same time often leads to conflicts and slower loading times. It is better to have one well-configured plugin combined with secure hosting, backups and regular maintenance. This is exactly the combination we offer as part of our WordPress maintenance.

Security and GDPR

Website security is also a legal matter. The GDPR (DSGVO) requires appropriate technical and organisational measures to protect personal data. Anyone who runs contact forms, customer accounts or an online shop processes such data. Encryption, up-to-date software, access restrictions and backups are therefore among the basic obligations of every website operator.

How Kodlogy helps with WordPress security

As a WordPress agency Vienna, we make sure that your website stays secure, fast and up to date. We check the current state, close gaps, set up backups and a firewall and, if you wish, take over ongoing maintenance. If your website has already been hacked, we clean it up and secure it against renewed attacks. You can find all services relating to protection and emergency help on the page WordPress security Vienna.

Frequently asked questions about WordPress website security

Is WordPress secure?

Yes, the WordPress core is maintained by a dedicated security team and many developers, and security vulnerabilities are usually closed quickly. Most attacks succeed via outdated plugins and themes, weak passwords or insecure hosting – in other words, via points that you can influence yourself.

Which security plugin is recommended for WordPress?

Proven options include Wordfence, Solid Security (formerly iThemes Security) or Sucuri. More important than the name is the right configuration: firewall, login protection, two-factor authentication and malware scans. A security plugin does not replace updates and backups.

How often should I back up my WordPress website?

That depends on how often content changes. For business websites, daily automatic backups make sense; for online shops with ongoing orders, even more frequently. It is important that backups are stored externally and that restoring them is tested regularly.

How can I tell that my WordPress website has been hacked?

Typical signs are unknown administrators, redirects to other sites, spam content in Google, warnings in the browser or in Search Console, and suddenly slow loading times. In this case you should act quickly and have the website cleaned up professionally.

What should I do if my WordPress website has been hacked?

Change all passwords immediately, inform your hosting provider and save the current state for analysis. Then the malware is removed, the vulnerability is closed and, if necessary, the website is restored from a clean backup. We can help – find out more on the page WordPress security Vienna.

Should I enable automatic updates?

Minor security updates to the WordPress core run automatically by default. For plugins and themes, automatic updates can make sense, but they carry the risk that an unchecked update breaks something. Ideal are regular updates with a backup beforehand and a functional check afterwards.

Is an SSL certificate enough for security?

No. SSL encrypts the connection between visitor and website and is mandatory, but it does not protect against attacks via outdated plugins or stolen passwords. It is one important building block among several.

How much does professional WordPress maintenance cost?

The costs depend on the size of the website, the number of plugins and the service you want. After a short analysis we prepare a fixed-price quote. Find out more on the page WordPress maintenance Vienna.

Should I hide the WordPress version number?

Hiding the version number makes life slightly harder for automated attackers and is done quickly; many security plugins handle this automatically. Real protection, however, only comes from an up-to-date WordPress version.