Why WordPress Security Isn’t Optional Anymore
WordPress runs a huge share of the web — which is exactly why it’s such a popular target. Security researchers logged more than 11,000 new WordPress vulnerabilities in 2025 alone, most of them in plugins and themes rather than WordPress core itself.
The good news? You don’t need to become a security expert to protect your site. You just need the right basics in place, done consistently. Here’s what actually matters.
The Short Version
- Keep everything updated — core, plugins, and themes
- Use strong, unique passwords and turn on two-factor authentication
- Take regular backups, stored off your server, and actually test them
- Lock down file permissions and disable the built-in file editor
- Run HTTPS everywhere, not just on your checkout or contact form
- Scan for malware regularly, not just when something looks wrong
- Choose hosting that takes security seriously
- Delete plugins and themes you’re not using
- Run one good security plugin, not three fighting each other
9 WordPress Security Basics Every Small Business Site Needs
- Keep WordPress, plugins, and themes updated. Most successful attacks exploit vulnerabilities that were already patched weeks or months earlier. If you’re not updating promptly, you’re leaving a known door unlocked.
- Use strong passwords and enable two-factor authentication. A long, unique password stored in a password manager, combined with 2FA on every admin account, blocks the vast majority of automated login attempts on its own.
- Limit login attempts and protect your login page. Bots hammer
/wp-login.phparound the clock. Rate-limiting failed logins and adding basic bot protection cuts out most of that noise before it becomes a problem. - Back up regularly — and actually test the restore. A backup you’ve never restored from is a backup you don’t really have. Off-site, automated, and tested: that’s the standard to aim for — and it’s one of several hidden costs of a neglected WordPress site that only show up once it’s too late.
- Lock down file permissions. Folders set to 755 and files to 644,
wp-config.phpprotected, and the theme/plugin file editor disabled in the dashboard removes an easy route attackers use once they’re in. - Force HTTPS across the whole site. Not just on forms — everywhere. It protects data in transit and, as I’ve covered before, it’s also a ranking signal Google cares about.
- Run malware scans on a schedule. Malicious code can sit quietly on a compromised site for months before it’s noticed — usually when Google flags the site or a client asks why they’re getting spam. Regular scanning catches it far earlier.
- Choose hosting that’s actually built for WordPress. A host offering server-level firewalling, isolation between accounts, and real malware response is worth far more than a few pounds saved on cheap shared hosting. Not sure if yours measures up? Here’s what I look for in WordPress hosting.
- Remove what you’re not using. Deactivated plugins and themes are still code sitting on your server, and still exploitable — and as I’ve written about how many plugins a site actually needs, most sites carry more than they should. If you tried it and didn’t keep it, delete it — don’t just switch it off.
You Don’t Have to Do This Alone
Most small business owners don’t have the time, and shouldn’t need the time, to stay on top of all of this themselves.
That’s exactly what I handle as part of my WordPress Maintenance Plans — updates, backups, monitoring, and hardening, done properly and quietly in the background so your site stays safe and you stay focused on running your business. If something’s already gone wrong, my WordPress Support service covers cleanup and fixes too.
If you’re not sure how exposed your current site is, I’m happy to take a look.
Get in touch and I’ll give you an honest read on where things stand.