TL;DR:

  • Most WordPress compromises happen through outdated plugins, weak admin passwords, or abandoned old installs — not sophisticated hacking
  • Automatic updates for WordPress core, themes, and plugins prevent the majority of attacks
  • A Web Application Firewall (WAF) and regular backups are the two highest-return additions for small business sites

If your business has a website built on WordPress, keeping it secure is part of running the business — just like keeping your premises locked and your accounts backed up. The good news is that most WordPress compromises are preventable with basic maintenance. The bad news is that “basic maintenance” doesn’t happen by default; you have to set it up.

Here’s what actually matters, in order of impact.

1. Enable Automatic Updates

The single most effective thing you can do. WordPress core, themes, and plugins all release security updates regularly, and attacks follow known vulnerabilities very quickly — sometimes within hours of a public disclosure. If you’re still running a plugin version from six months ago, there’s a good chance it has a known vulnerability that automated scanners are actively probing.

WordPress has automatic updates built in. Make sure they’re enabled:

  • WordPress core: Go to Dashboard → Updates. In wp-config.php, the setting define('WP_AUTO_UPDATE_CORE', true); enables automatic minor and major updates.
  • Plugins and themes: In the Plugins list, click “Enable auto-updates” for each plugin. Do the same in Appearance → Themes.

The main objection to auto-updates is “what if an update breaks my site?” This is a real concern, which is why you need backups (see step 5) — but an unpatched vulnerability is a much higher risk than a plugin update causing a layout issue.

2. Use a Strong, Unique Admin Password and Change the Default Username

The default WordPress admin username is admin. Attackers know this and run automated login attempts trying common passwords against /wp-login.php on millions of sites daily.

Change the admin account to something that isn’t “admin” — go to Users → Profile and change the username. Use a strong, unique password (20+ characters, generated by a password manager). Don’t reuse your email password or anything you use elsewhere.

If you have multiple users on the site, audit who has Administrator role and remove it from anyone who doesn’t need it. Contributors and editors don’t need admin access.

3. Add Two-Factor Authentication on Admin Accounts

A strong password is good. Two-factor authentication means that even if someone steals your password, they still can’t log in without your phone.

Free plugins that add 2FA to WordPress:

  • Two Factor (WordPress.org) — simple, supports authenticator apps and email codes
  • Wordfence Login Security — 2FA plus login attempt limiting
  • miniOrange 2 Factor Authentication — supports multiple 2FA methods

Enable 2FA for all accounts with Administrator or Editor roles.

4. Install a Web Application Firewall

A Web Application Firewall (WAF) sits in front of your WordPress site and blocks malicious requests before they reach your code — things like SQL injection attempts, cross-site scripting, and automated vulnerability scanning.

For WordPress, the easiest options are:

  • Wordfence (free tier available) — a WordPress plugin that includes a WAF, malware scanner, and login protection. The free tier provides delayed updates to WAF rules; the paid version (around £100/year) gets real-time protection.
  • Cloudflare (free tier) — point your domain’s DNS through Cloudflare, which acts as a reverse proxy and applies WAF rules before traffic reaches your hosting. The free tier provides basic protection; the Pro plan (around £20/month) adds WordPress-specific rules.

If your site is hosted on managed WordPress hosting (WP Engine, Kinsta, SiteGround’s managed tier), a WAF is often included — check with your host before adding a separate plugin.

5. Set Up Automated Backups

If your site is compromised, a clean backup from before the attack is how you recover without paying a developer hours of forensic cleanup. Backups also save you from plugin update issues, accidental content deletion, and hosting provider failures.

Your backup needs to cover two things: the database (all your posts, pages, settings, and user accounts) and the files (WordPress core, themes, plugins, and uploaded media).

Good backup options:

  • UpdraftPlus (free plugin) — scheduled automated backups to Dropbox, Google Drive, or Amazon S3. Easy to restore from the admin panel.
  • Your hosting provider’s backups — most hosts provide daily backups, but check the retention period and whether you can actually restore from them. Don’t rely on host backups alone.

Aim for: daily database backups retained for 30 days, weekly full-site backups retained for 3 months. Store at least one copy off-site (not on the same hosting account).

6. Delete Unused Plugins and Themes

Every inactive plugin or theme on your site is attack surface even if it’s deactivated. Attackers scan for vulnerabilities in inactive plugins because some vulnerabilities can be triggered without the plugin being active.

Audit your plugins list: delete anything you’re not using. Same for themes — keep only the active theme and one backup theme (Twenty Twenty-Three or similar default), delete the rest.

7. Limit Login Attempts

By default, WordPress allows unlimited login attempts. Attackers use this to run password-guessing attacks automatically. Limiting login attempts stops this at the source.

Wordfence and similar security plugins include this feature. If you’re using a minimal setup, Limit Login Attempts Reloaded (free, 1M+ installs) handles this specifically.

Configure to lock out an IP after 5 failed attempts for 20 minutes, and after 3 lockouts, lock out for 24 hours.

8. Protect the wp-admin Directory

You can restrict access to the WordPress admin area by IP address — if you always access your site from home or from the office, adding an IP restriction means attackers trying to reach /wp-admin from elsewhere get blocked before they see the login form.

This is done in your .htaccess file (for Apache hosting) or through your hosting control panel. Ask your host if you’re not sure how.

For businesses with dynamic IPs or multiple users accessing from different locations, this may not be practical — in which case 2FA (step 3) is the equivalent protection.

9. Use HTTPS and Keep Your SSL Certificate Current

Your site should be served entirely over HTTPS — modern browsers warn users if it isn’t, and Google uses HTTPS as a ranking signal. Most UK hosts provide free SSL certificates via Let’s Encrypt.

Check that your certificate renews automatically (Let’s Encrypt certificates expire every 90 days — auto-renewal should be configured by your host). An expired certificate warning will drive away customers as effectively as a security incident.

10. Check Your Site Regularly

Security plugins with scanning features (Wordfence, Sucuri Security) can check your site’s files against known malware signatures. Run a scan periodically — monthly at minimum, weekly if your site is actively updated.

Also check Google Search Console for any security alerts. Google frequently detects compromised sites before the site owner notices — if Google has flagged your site as malicious, you’ll find it in Search Console under Security Issues.

If you get hacked: most UK managed hosting providers offer malware cleanup as a paid service. Sucuri and Wordfence both offer cleanup services. Having a clean backup to restore from (step 5) is usually faster and cheaper than forensic cleanup.