WordPress powers a huge portion of the world’s websites, making it the favorite target for automated attacks: programs that scour the internet relentlessly looking for sites with poorly secured entry points. The good news is that almost all these attacks exploit oversights that can be avoided. Here are the key measures we apply to the websites we maintain.
1. Core, plugins, and theme always up to date
Most hacked WordPress sites had been months without updating something: the core, a plugin, or the theme. When a vulnerability is published, attackers take very little time to find sites still running the old version. Updating in a timely manner is, by far, the most effective measure.
That said: updating blindly also carries risk. The ideal approach is to do it with a recent backup, one update at a time, and verifying that the site continues to function after each change.
2. Fewer plugins, and only from reliable sources
Each plugin is third-party code within your website. Review the ones you have installed and remove those you no longer use (disabled ones still count: they remain on the server). Install only plugins from the official repository or from recognized developers, and be wary of «free premium» versions circulating online: they are one of the most common ways to introduce malware.
Pay attention also to abandoned plugins, those that have gone years without an update: if a security flaw appears, no one will fix it.
3. Strong passwords and two-factor authentication
Brute-force attacks try thousands of username and password combinations against the login screen. Use long, unique passwords (a password manager helps greatly), do not use «admin» as a username, and enable two-step verification for administrators.
4. Administrators, only those necessary
Each administrator account is a master key to the website. Give each person only the role they need (editor, author…) and delete accounts of anyone who no longer works on the site. An administrator account that no one remembers creating is a clear sign that something is wrong.
5. Backups off-server
A backup stored on the same server as the website is of little use if the server fails or if the attacker encrypts it along with everything else. Schedule automatic backups, store them elsewhere, and occasionally verify that they can be restored: a backup that has never been tested is just a hope.
6. HTTPS across the entire site
The SSL certificate encrypts what travels between the visitor and the website, including login passwords and form data. It is essential today, also for Google. Ensure it renews automatically and that the entire site loads via https.
7. Monitor even when everything seems fine
Many attacks go unnoticed: the site continues to function while sending spam, redirecting visitors from mobile devices, or hiding links from other websites. That is why continuous monitoring is advisable: ensuring it remains online, that no suspicious files appear in the uploads folder, and that no installed plugin has known vulnerabilities.
8. Hosting with updated PHP
WordPress runs on PHP, and old versions of PHP stop receiving security patches. Check with your hosting provider that your site uses a supported version and that the server is properly configured. If your site still runs on an old PHP version, we can help you update PHP without breaking the site.
What if you have already been attacked?
No rush and no deleting things randomly. First, restore a clean backup from before the attack. Then, change all passwords (WordPress, hosting, database, and FTP), review administrator users, update everything, and look for files the attacker may have left to regain access. If you do not know where to start, we clean hacked websites and provide a free diagnosis on the same day.
We take care of it
At Cint Consulting, we audit and secure websites built with WordPress and keep them up to date: controlled and verified updates, off-server backups, uptime and certificate monitoring, and vulnerability and suspicious file detection. More information on our WordPress Maintenance service, or contact us and we will review your site.
