Keep software and ownership current
Maintain an inventory of WordPress core, themes, plugins, hosting components, and integrations. Remove software that is no longer used, assign an owner to monitor security advisories, and test important updates on staging before applying them to production.
Limit access and protect accounts
- Use individual accounts rather than shared administrator logins.
- Grant each account the lowest role needed for its work and remove access when it is no longer required.
- Require strong, unique passwords and multi-factor authentication for privileged accounts.
- Review hosting, DNS, domain registrar, payment, and backup access—not only WordPress users.
Make backups recoverable
Keep backups separate from the production account where practical, protect access to them, and define how much data loss and downtime the business can tolerate. Periodically restore a backup to a safe environment and verify the database, uploads, configuration, and key site workflows. A backup that has never been tested is an assumption, not a recovery plan.
Monitor and prepare to respond
Use appropriate host-level protections, malware and file-change monitoring, and logs that help investigate suspicious activity. Document who can isolate the site, rotate credentials, contact the host, restore service, and communicate with affected stakeholders. Keep incident steps and emergency contacts available outside the WordPress installation.
Reassess after changes
Review the setup after a redesign, plugin change, new integration, or change in staff. Security controls should fit the site's risk, data, and operating model; no checklist or tool can guarantee that a site will never be compromised.
For a structured review, see our WordPress performance and security service or maintenance plans.