WordPress Security Basics for Business Owners

WordPress security is a set of responsibilities. A single plugin cannot take over all of them.

Know who has access

Review administrator accounts and remove access that is no longer needed. Use individual accounts and the least privilege appropriate to each role. Strong, unique passwords and a maintained multi-factor authentication solution can strengthen login protection.

Protect hosting, domain and email accounts too. Those systems can matter as much as WordPress administration. Be cautious about messages asking you to enter credentials on an unfamiliar page.

Maintain the software you depend on

Use trustworthy software sources and keep WordPress, themes and plugins supported. Review unused components and investigate software that no longer receives maintenance. Updates reduce known exposure; they do not promise that a site can never be compromised.

Have a recovery route

Retain independent backups and rehearse restoration. Keep access to the recovery tools separate from routine publishing wherever practical. Document who can act if normal administration becomes unavailable.

Recognize warning signs

Unexpected administrator accounts, redirects, altered pages or unexplained outgoing messages deserve investigation. Preserve relevant evidence and speak with the hosting provider or your technical contact. Restoring a copy alone may not address the original route of compromise.

Ask useful questions

• Who is responsible for updates and account review?
• Which systems can change the site or its domain?
• Where is the independent recovery copy?
• What has actually been tested?

Security should be explained in terms of controls and remaining risks. Avoid promises of complete protection or assumptions that HTTPS prevents every kind of attack.

Ask for WordPress troubleshooting help if you see behavior you cannot explain.

Official reference

WordPress: hardening and reducing risk