Topic hub

WordPress Security

WordPress security is a system of ownership, supported software, access control, backups, monitoring and incident response. No single plugin can make a neglected site secure.

2 published guides0 subtopicsUpdated 21 July 2026

Start here

The main guide for this topic

Practical guide

How to Secure a WordPress Website

Secure a WordPress website by protecting the accounts and server first, then reducing extension risk, testing backups and monitoring important changes. Apply controls in layers so that one failure doe…

Open the complete guide →

Published guides

Articles in this section

Practical guide30 September 2026

How to Secure a WordPress Website

Secure a WordPress website by protecting the accounts and server first, then reducing extension risk, testing backups and monitori…

Read guide →

Step-by-step9 September 2026

WordPress Malware Removal

Malware removal is an incident-response process, not simply deleting the file named by a scanner. The immediate priorities are to …

Read guide →

About this section

WordPress security is a system of ownership, supported software, access control, backups, monitoring and incident response. No single plugin can make a neglected site secure.

Start with the highest-value controls

Routes through the Security section
Risk	Begin with	Expected control
Weak or shared access	WordPress Security Basics	Named accounts, strong passwords and least privilege
Outdated software	How to Secure a WordPress Website	Documented update and testing process
Failed recovery	How to Back Up WordPress	Independent copies and tested restoration
Suspicious behaviour	WordPress Malware Removal / troubleshooting guides	Logs, containment and professional incident handling
Excessive extension risk	How to Choose WordPress Plugins Safely	Due diligence and a minimal supported stack

Security responsibilities are shared

The hosting provider secures and maintains its infrastructure within the service boundary
WordPress core maintainers publish supported releases
Theme and plugin suppliers maintain their code
The site owner controls accounts, configuration, updates, data and suppliers
Developers and administrators implement and document changes

Core security layers

Access

Use named users, strong unique passwords, multi-factor authentication where available and the lowest role needed. Remove former staff and suppliers promptly.

Supported software

Keep WordPress, PHP, the database, themes and plugins on supported versions. Remove abandoned code rather than leaving it inactive on the server.

Hosting and transport

Use HTTPS, secure file transfer, appropriate permissions, protected configuration and competent server administration.

Backups

Store restorable files and database copies outside the live site. Test recovery before an incident.

Monitoring

Watch uptime, unexpected file changes, administrator accounts, failed logins and critical business journeys. Alerts need a named responder.

Security plugins have a defined role

They may add firewall rules, login protection, scanning or alerts. They cannot compensate for stolen hosting access, unsupported PHP, missing backups or an administrator who ignores warnings.

Prepare for an incident

Know how to take the site offline or restrict access
Preserve logs and evidence
Reset credentials through a clean device
Identify data and regulatory consequences
Restore from a known-good source
Document what happened and prevent recurrence

Practical next step

Assign one named owner for updates, backups and security alerts. Then verify that person can restore the site and revoke a supplier account without relying on the supplier.

Prioritise business impact

A hacked brochure page, stolen administrator account and compromised shop do not have identical consequences. Identify the data, revenue and reputation at risk, then match monitoring and response speed to those consequences.

Evidence of a working security process

Current user and supplier access list.
Update records and staging checks.
Successful recent backup and restore test.
Alerts delivered to a monitored address.
Documented incident contacts and containment steps.
Proof that former credentials have been revoked.

A collection of security settings without this operational evidence is difficult to trust.

Sources and date checked

This guide was checked on 21 July 2026. WordPress, hosting environments and extensions change, so recheck the relevant official documentation before making a major change.