Most attacks on small business websites aren’t personal. Automated bots scan millions of sites a day looking for an outdated plugin, a weak password or an exposed login page. The good news is that the same few precautions stop almost all of them.
Here is the checklist I run on every site I manage, roughly in order of impact.
Accounts and access
- Use unique, long passwords for WordPress, hosting, the domain registrar and email, stored in a password manager.
- Turn on two-factor authentication for every administrator account.
- Give people the lowest role they need. Writers don’t need administrator access, and ex-staff and old agencies shouldn’t have any.
- Protect the login page with rate limiting or a firewall rule, so bots can’t guess passwords all day.
Software
- Keep WordPress, themes and plugins updated. Most break-ins exploit vulnerabilities that already have a fix.
- Delete what you don’t use. Deactivated plugins can still be exploited.
- Never install nulled themes or plugins. “Free” copies of premium software are one of the most common ways malware arrives.
- Run a supported PHP version on your hosting.
Infrastructure
- Serve everything over HTTPS with an SSL certificate that renews automatically.
- Put a web application firewall in front, such as Cloudflare, to block malicious traffic before it reaches your server.
- Keep automatic, off-site backups and test that you can actually restore one.
- Monitor uptime and file changes, so you hear about problems before your customers do.
How often to check
| Task | How often |
|---|---|
| Plugin, theme and core updates | Weekly |
| Backup check and test restore | Monthly |
| Review admin users and access | Quarterly |
| Full security scan | Monthly |
| SSL, DNS and firewall review | Twice a year |
Security isn’t a product you buy once. It’s a few small habits done every week.
If you only do three things
- Turn on two-factor login for every admin.
- Update everything, and remove what you don’t use.
- Make sure you have a recent backup stored somewhere other than your server.
Rather not think about it at all? My care plans cover updates, backups, monitoring and security for WordPress sites. Ask me on WhatsApp what that would look like for your site.
