Most small business websites aren’t targeted for drama — they’re vulnerable because basic defenses are missing. This guide lists ten practical, non-technical steps you can implement yourself or hand to a developer. Each step reduces risk quickly and keeps your site available for customers and search engines.
1. Keep WordPress, themes and plugins updated
Updates patch known vulnerabilities. Check your site weekly and apply updates for WordPress core, your active theme, and plugins. If you can’t update safely, schedule a developer to run updates on a staging copy first to avoid breaking custom features.
2. Use a reputable host with WordPress-focused protections
Switch to a host that offers malware scanning, automatic backups, and account isolation. Managed WordPress hosts often include caching and automatic updates for core — ask your host or developer how their stack defends against common exploits.
3. Enforce strong, unique passwords and two-factor authentication
Require strong passwords for admin accounts and enable two-factor authentication (2FA) for all users with elevated access. Plugins like Wordfence or two-factor providers can add this without technical overhead.
4. Limit admin access and use least privilege
Give people only the capabilities they need. Create separate editor, author, or contributor accounts rather than sharing an administrator login. Remove or archive accounts for former employees immediately.
5. Secure backups with an off-site strategy
Backups are your insurance. Schedule daily or weekly backups depending on how often content changes, and store copies off-site (cloud storage or a managed backup service). Periodically test a restore to confirm backups are usable.
6. Add a web application firewall (WAF)
A WAF blocks many common attacks before they reach your site. Cloud-based services (CDN providers like Cloudflare or managed WAFs) are easy to deploy and reduce brute-force login attempts, SQL injection attempts, and automated bots.
7. Protect the login page and rename or limit access
Change the default login URL from /wp-login.php or /wp-admin to something unique, or limit access by IP for admin-level accounts. If you work with a developer remotely, use temporary access or a VPN so admin pages aren’t exposed to everyone.
8. Harden file and folder permissions
Correct file permissions prevent attackers from modifying files. For most hosts, files should be 644 and folders 755. Your developer or host support can confirm permissions and ownership, especially after migrations.
9. Use SSL/TLS and set secure cookies
Serve the entire site over HTTPS. A valid SSL/TLS certificate is typically free from your host or certificate authority. Ensure cookies are marked secure and use HTTP Strict Transport Security (HSTS) where appropriate.
10. Monitor and respond quickly
Set up uptime monitoring and simple alerting for suspicious activity. Regular scans from a reputable security plugin or your host can detect injected files or modified core files. Create a short incident plan: who to call, which backups to restore, and where to find admin credentials.
Checklist to hand to your developer or IT partner
- Run all pending WordPress, theme, and plugin updates on staging first.
- Confirm daily or at-least-weekly backups stored off-site and test a restore.
- Install a WAF (cloud-based is fine) and enable rate limiting.
- Enable 2FA for all admin accounts and rotate shared credentials.
- Review user roles and remove unused accounts; enforce least privilege.
- Harden file permissions, disable file editing through the dashboard, and protect wp-config.php.
- Implement SSL across the site and set secure cookie flags.
- Limit admin page access by IP when practical or move login off the default URL.
- Subscribe to uptime monitoring and configure security alerts.
- Document recovery steps and the location of credentials and backups.
Simple fixes you can do yourself today
- Change passwords to long, unique passphrases and enable 2FA.
- Remove unused plugins and themes — even inactive ones can be exploited.
- Turn on automatic updates for minor core releases in Settings or wp-config if comfortable.
- Install an SSL certificate via your host and force HTTPS in WordPress settings.
When to call a professional
If your site was previously hacked, you see strange redirects, or search engines flag malware, call a developer who specializes in cleanup and hardening. For ongoing protection and monthly checks, a maintenance plan that includes updates, backups, and monitoring is a small price to pay compared with lost revenue and brand damage.
Conclusion and next step
Security doesn’t require deep technical knowledge — it needs a prioritized checklist and consistent maintenance. Start with updates, backups, and stronger login protections. If you want help implementing these steps or setting up a maintenance plan, contact a web developer who understands business priorities and WordPress specifics. For professional web development and secure maintenance options, see our services at Edwin Quijada Web Development.