WordPress security: the basics
You do not need to be a specialist to keep a site reasonably safe. WordPress security basics are a short list of habits, and the common break-ins happen on sites where those habits were skipped.
Is WordPress unsafe by nature?
No. It is open-source software maintained by a large community, and security fixes are released regularly. It is also very widely used, which makes it a frequent target for automated attacks that try the same weak points on a great many sites. Those weak points are rarely WordPress itself. They are old plugins, reused passwords and software nobody has updated.
How should passwords and accounts be set up?
Give every person their own account, with the lowest role that lets them do their work. An editor who writes posts does not need to be an administrator. Use long, unique passwords kept in a password manager, and switch on two-step login for administrators. When someone leaves the team or a freelancer finishes, remove their account the same day. Never share one login among several people.
Why do updates matter for security?
Because updates often close holes that have already been made public. Once a fix is released, attackers know exactly what to look for on sites that have not applied it. Keep WordPress, the theme and every plugin current, and delete the ones you no longer use. Install themes and plugins only from the official directory or from their makers, never from unofficial copies of paid products.
Where do backups fit in?
A backup is what turns a serious incident into a bad afternoon. If the site is damaged, you restore a clean copy instead of repairing it file by file. For that to work, the backup has to include both the files and the database, be stored somewhere other than the same server, and be recent. And someone has to have tried restoring it at least once.
What is the hosting company responsible for?
A good deal. The server software, the firewall in front of it, the certificate that puts the padlock in the address bar, and often automatic backups and malware scanning. Ask your host plainly which of these are included and which are extras you must switch on. A site on careless hosting may be exposed through a neighbour on the same server, however careful you are.
What do I do if something looks wrong?
Signs include pages you did not create, links to strange sites, a warning from the browser or from Google, or an administrator account you do not recognise. Do not start deleting things. Contact your hosting company and the person who built the site, change the passwords of every administrator, and be ready to restore from a clean backup. Acting on the same day limits the damage.
How I handle it
I build on WordPress with Elementor Pro and hand the site over with the dashboard, so the accounts and their roles are yours to control. Each project is designed in Figma first and approved by you before the build. Support lasts 180 days from the day the site goes live and covers anything that breaks or behaves differently from what was agreed. If you are worried about a site you already have, write to me with its address and I will reply within 24 hours.
New articles every day on our Facebook page: Learn with MK
Have a project in mind?
Tell me what you are building and I reply within 24 hours.
