How do I keep a small-business WordPress site secure?
Keep WordPress, plugins and themes updated, and delete what you don't use. Give each person their own login with the lowest role they need, protected by a long unique password and two-step login. Keep daily backups away from the server and test a restore. Then decide now who you'll call if the site is hacked.
The short version
- Update WordPress, plugins and themes, with a backup first and a check afterward.
- Delete plugins, themes and old copies you don’t use.
- One login per person, with the lowest role they need. No shared admin accounts.
- Long, unique passwords and two-step login on every admin account, plus hosting, registrar and email.
- Daily backups stored off the server, with a test restore every few months, and a plan for a bad day.
Why do small-business sites get attacked?
Most attacks on small-business sites aren’t personal. Automated tools scan huge numbers of sites for known weak spots: an old plugin with a published flaw, a login that accepts “admin” and a guessable password, a forgotten test copy.
That’s good news. You don’t have to outsmart a determined attacker. You just have to not be an easy target. In our support records, the ways in we see most often are an out-of-date plugin or theme and a stolen or weak password. The habits below close both doors.
How do I keep WordPress updated without breaking things?
WordPress’s own hardening guide is direct: keep up to date with the latest version, because “older versions of WordPress are not maintained with security updates,” and keep plugins updated too. The same goes for themes.
Updates sometimes break a layout, form or checkout. That’s why people put them off, and putting them off is how sites get hacked. The answer is a routine:
- Back up first. Always.
- Update a test copy when you can, and check the pages that matter: home, contact form, booking, checkout.
- Update the live site when you can check it right afterward.
- Check again. Send a test form and load the key pages on a phone.
- Know how to roll back if something’s wrong.
Our answer on whether plugin updates can break your site covers this in more depth, and what a staging site is explains the test copy.
What about abandoned plugins?
A plugin that hasn’t been updated in a long time may no longer be maintained. If a flaw is found, no fix may come. Prefer plugins with recent updates and active support, and plan to replace any that have gone quiet.
Why delete plugins and themes I’m not using?
The hardening guide says that if you’re not using a plugin, “delete it from the system.” Deactivated plugins still sit on the server, and their code can still have flaws.
- Delete deactivated plugins you don’t plan to use.
- Delete unused themes, keeping one default theme as a fallback if your setup needs it.
- Remove old test pages, staging copies and “backup” folders left on the live server.
- Look for plugins that do the same job twice, like two slider or SEO plugins.
Fewer plugins usually means a faster, steadier site as well. Our answer on how many plugins is too many explains how to choose which to keep.
How should I set up logins and roles?
Shared logins are a common weakness. When five people use one admin account, you can’t tell who did what, and you can’t remove one person without changing it for everyone.
- One account per person. No shared “office” login.
- Give each person the lowest role they need. Someone who writes blog posts doesn’t need to be an Administrator.
- Remove accounts for former staff and vendors right away.
- Don’t use “admin” as a username.
- Review the user list monthly.
Our answer on which WordPress role to give your staff explains what each role can do, and our help article on adding or removing someone’s access has the steps.
What makes a password strong enough?
Password advice has changed. NIST’s current digital identity guidelines say:
- A password used on its own should be at least 15 characters. One used alongside two-step login can be shorter, but at least 8.
- Systems shouldn’t force composition rules, like “must include a symbol,” or make you change passwords on a schedule.
- A password must be changed when there’s evidence it’s been exposed.
- Password managers and autofill should be allowed.
The WordPress hardening guide also recommends generated passwords and warns against dictionary words and short passwords. In practice: use a password manager, let it create a long password for each account, and never reuse your WordPress password anywhere else. Our answer on managing business passwords covers the setup for a team.
Should I turn on two-step login?
Yes. CISA’s MFA page describes multifactor authentication as needing two or more proofs before access, and says people who use it are “significantly less likely to get hacked.” The WordPress hardening guide recommends two-step authentication too.
- Turn it on for every administrator, at minimum.
- Prefer an authenticator app, passkey or security key over text-message codes where you can. CISA calls phishing-resistant MFA the standard to aim for, while saying any MFA is better than none.
- Store backup codes in your password manager.
Do the same for your hosting account, domain registrar and email. Anyone who gets into your email can reset almost everything else. Our answer on two-factor authentication helps you choose a method.
What do good backups look like?
Backups are your safety net for hacks, bad updates and plain mistakes. The hardening guide says to back up regularly, including the database, and keep copies in a trusted location.
- Automatic, daily for most business sites.
- Complete: files and database.
- Off the server. If the server fails or is compromised, backups stored on it can go too.
- Kept long enough. If a hack goes unnoticed for two weeks, yesterday’s backup isn’t enough.
- Tested. Restore something every few months.
Our answer on how often to back up WordPress goes further.
What can my host and firewall do?
Some protection comes from where your site lives:
- A host that keeps its servers updated and supports current versions of the software WordPress needs.
- SSL on every page. If you see a “Not secure” warning, read why a site says Not Secure.
- A firewall, at the host or in front of the site, to block automated junk before it reaches WordPress.
- Sensible file permissions. The hardening guide says files should be owned by your user account, with web server write access only where it’s needed. That’s your host’s or developer’s job, but worth asking about.
A reputable security plugin can add login limits, file-change alerts and malware scans. It can’t make up for skipped updates, shared passwords or missing backups. Pick one, read its alerts, and make sure whoever maintains the site knows how to get back in if a setting locks people out.
What are the warning signs of a hack?
Many hacks are quiet. Watch for:
- New admin users you didn’t create.
- Pages or links you didn’t add, often to pharmacy, casino or loan sites.
- Customers saying the site sends them somewhere strange.
- A warning from Google Search Console or a browser. See why Google says a site may be harmful.
- A sudden slowdown, or a flood of spam sent from your domain.
What should my plan for a bad day include?
Decide now, while things are calm:
- Who do you call? Your developer, your host or a care provider.
- Where are the backups, and who can restore them?
- Who has the logins? If that person is away, can anyone else get in?
- What will you tell customers if the site is down or was used to send spam?
If you think the site has been hacked, our help article on what to do if your site was hacked walks through the first hour. If the site shows a white screen or “critical error” after an update, read what a critical error or white screen means.
What are the most common mistakes?
- Putting off updates because one broke something once.
- Deactivating plugins instead of deleting them.
- Sharing one admin login with staff and vendors.
- Backups kept only on the same server.
- Several security plugins at once, with alerts nobody reads.
- Blocking yourself out. A login page that shows a 404 or blocked page is often a security tool doing its job on the wrong person; see why your login page is blocked.
How much time does it take?
| Habit | How often |
|---|---|
| Install updates, with a backup first | Weekly |
| Check backups ran | Weekly |
| Review users and remove old accounts | Monthly |
| Delete unused plugins and themes | Monthly |
| Confirm two-step login on all admin accounts | Monthly |
| Test a backup restore | Every few months |
| Review hosting, SSL and access | Yearly |
Most weeks it’s 15 minutes. Our website care checklist puts these alongside the non-security checks.
How does E-3 handle this?
Security is built into our website care service: uptime monitoring, tested updates, daily backups and security alerts. Our managed hosting includes SSL. Updates are tested on a staging copy first, and daily backups mean the site can be restored if something goes wrong. Nobody can honestly promise a site will never have a problem, so we won’t. We’ll make it a much harder target and have a plan ready.
Related questions
Common questions
- Is WordPress insecure?
- WordPress itself is actively maintained and gets security updates. The usual problems on small-business sites are out-of-date plugins and themes, weak or shared logins, and missing backups, which are all things you can control.
- Do I need a security plugin?
- One reputable security plugin or a firewall at your host can help, but neither replaces updates, two-step login and backups. Don't run several security plugins at once; they can conflict.
- How often should I change my WordPress password?
- NIST's current guidance says not to force routine password changes. Use a long, unique password with two-step login, and change it right away if there's any sign it's been exposed.
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.