3 Quick Fixes for WordPress Security Basics for Small Businesses

The fastest way to secure a WordPress site is to update everything, verify an off-site backup, and turn on strong login authentication. Those three moves close the doors that most automated attacks walk through. Everything else in WordPress security basics builds on that foundation, and the audit checklist further down gives you the exact next steps once the essentials are done.

TL;DR:

• Automated bots probe WordPress sites continuously, targeting outdated plugins, weak passwords, and vulnerable server configurations; layered controls and recovery plans are essential.
• Using managed hosting with automatic patching, strong server security features, and regular testing of full backups significantly reduces the risk of a successful attack.
• Regularly updating WordPress core, plugins, themes, and verifying off-site backups with restore tests are critical for quick recovery after incidents.
• Enabling two-factor authentication, restricting login attempts, and removing default usernames greatly improve login security for administrative accounts.
• Conducting monthly security audits to check software versions, permissions, plugin inventory, and log activity helps prevent breaches and facilitates prompt incident response.

Table of Contents

• Why WordPress Sites Get Hacked: Common Attack Vectors in 2026
• Choose Secure Hosting and Harden Your Server
• Keep Software Up to Date and Backups You Can Actually Restore
• Protect Logins and User Accounts
• Plugin, Theme, and Supply-Chain Hygiene
• File Permissions, wp-config Protection, and Upload Folder Limits
• Add a Firewall, Monitoring, and Basic Detection
• The Security Audit and Recovery Checklist You Can Run Today
• Why Trust This Guide
• What to Prioritize This Month
• Get a Free Site Audit Before Something Breaks
• Sources
• FAQ

Why WordPress Sites Get Hacked: Common Attack Vectors in 2026

WordPress itself is not the weak point. The gaps come from what site owners install, delay, or leave configured wrong. Attackers rarely target one business by name. Instead, they run automated scans across millions of sites looking for known weaknesses, then strike wherever the door is open.

The recurring entry points include:

• Credential theft, including reused or weak passwords caught in stuffing attacks against login pages.
• Vulnerable plugins and themes, especially abandoned ones with known, unpatched flaws.
• Outdated core software or old PHP versions that no longer receive security patches.
• Misconfigured servers, such as writable folders or exposed configuration files.
• Supply-chain attacks, where a compromised plugin update or third-party library introduces malicious code.
• Automated botnets, which now probe login forms and known vulnerabilities around the clock rather than waiting for a human attacker.

That last point matters more each year. Automated tools do not get tired, do not sleep, and do not care how small your business is. A bakery’s booking site and a national retailer’s storefront get scanned by the same bots, often within minutes of a new vulnerability being published. This is why hardening guidance from WordPress frames security as risk reduction rather than a one-time fix: layered controls plus a recovery plan, not a single magic setting.

Credential stuffing and phishing remain leading initial access methods for compromised WordPress admin accounts, according to security hardening research, which is why two-factor authentication for privileged accounts shows up repeatedly in this guide. Once an attacker gets past a weak login or an unpatched plugin, they typically plant a backdoor, not just a defacement, so they can return even after you notice something is wrong. That is why recovery planning matters as much as prevention.

Choose Secure Hosting and Harden Your Server

Your host does a lot of the heavy lifting whether you realize it or not. Managed WordPress hosting typically includes automatic patching, account isolation from other customers on the same server, and one-click snapshot restores, all of which reduce the odds that a single misstep turns into a full-blown incident.

Before you commit to a host, or if you are reviewing your current one, check for these server-level protections:

• TLS 1.2 or newer (ideally TLS 1.3) enforced for all traffic, not just the login page.
• HSTS enabled so browsers refuse to connect over plain HTTP.
• Server tokens hidden so version numbers are not advertised to scanners.
• A host-level firewall separate from anything running inside WordPress itself.
• Fail2Ban or equivalent to block IP addresses after repeated failed logins.
• Rate limiting on login and XML-RPC endpoints.
• A clear PHP support policy stating which versions are patched and for how long.
• One-click rollback to a previous snapshot if an update breaks something.

Ask a prospective host directly: how often do you patch the server stack, do you isolate customer accounts from each other, and how far back do your backups go? A host that cannot answer clearly is a red flag. The WordPress Hosting Handbook notes that keeping WordPress and its plugins current is the single most important defense, but it only works if the hosting environment underneath is not itself the weak point.

Pro Tip: If budget is tight, spend it on hosting quality before spending it on a security plugin. A hardened server blocks far more automated attacks than any plugin running on top of a loose one.

Keep Software Up to Date and Backups You Can Actually Restore

Updates and backups are the two habits that separate sites that recover from an incident in an afternoon from sites that lose everything. Neither is optional, and neither is complicated once it is set up correctly.

1. Turn on automatic background updates for WordPress core where your host supports it. WordPress’s own upgrade documentation explains how these updates work and how to configure them for your environment.
2. Run plugin and theme updates through a staging copy first when possible, rather than pushing straight to your live site, especially for major version jumps.
3. Check your PHP version against your host’s support policy using the Site Health tool built into WordPress, and plan migrations before your version stops receiving security patches.
4. Confirm your backup covers the full picture: the database, every WordPress file, and the .htaccess file, not just uploads or just the database.
5. Store backup copies outside your hosting account, so a compromised or suspended host account cannot take your backups down with it.
6. Test a full restore periodically, ideally onto a staging site, rather than assuming the backup works because a job ran successfully.

A backup that has never been restored is a guess, not a safety net. WordPress’s official backup guidance is explicit that copies should be kept outside the hosting account and that restoration should be tested before you need it in an emergency. This is the step most small-business owners skip, and it is the one that turns a bad afternoon into a genuine crisis.

Protect Logins and User Accounts

Weak logins are still one of the easiest ways into a WordPress site, which makes this section some of the highest-value time you can spend. None of it requires technical training.

• Use a password manager like 1Password or Bitwarden to generate and store long, unique passphrases for every admin account.
• Turn on two-factor authentication, preferring TOTP apps or WebAuthn passkeys over SMS codes, which can be intercepted through number-porting scams.
• Rename or remove the default “admin” username, since it is the first guess in any automated attack.
• Limit login attempts so repeated failed tries lock out an IP address instead of allowing unlimited guesses.
• Rotate the secret keys in wp-config.php periodically, which invalidates old login cookies and session tokens.
• Set roles to least privilege, giving contributors and editors only the access their job actually requires, not full admin rights by default.

Security hardening guidance recommends mandatory two-factor authentication for anyone with admin or editor access, specifically because credential theft is one of the most common ways attackers get their first foothold.

Pro Tip: Set a calendar reminder to review who has admin access every three months. Former employees and old contractor accounts are a quiet, common way sites stay exposed long after the work is done.

Plugin, Theme, and Supply-Chain Hygiene

Every plugin and theme you install is code you did not write, running with access to your site. That is not a reason to avoid plugins entirely, but it is a reason to be selective and to clean up regularly.

When choosing new plugins or themes, look for active maintenance history, a track record of quick security patches, and a reasonably large install base, since obscure tools get far less scrutiny from the security community. Prefer official repositories or established vendors over random downloads from third-party sites, and where you have the technical ability, a quick code review before installing anything handling payments or user data is worth the time.

• Delete inactive plugins and themes entirely rather than just deactivating them, since dormant code can still be exploited.
• Keep a simple inventory of every plugin and theme in use and their versions, so you can react fast when a vulnerability is disclosed.
• When a vulnerability is published for something you run, consider a temporary web application firewall rule as a stopgap, apply the update through staging as soon as it is available, or deactivate the plugin entirely until a fix ships.

This kind of lightweight inventory is what a security benchmark for WordPress hardening calls an SBOM-style approach: knowing exactly what is installed so you are not scrambling to figure it out during an active incident.

File Permissions, wp-config Protection, and Upload Folder Limits

This is the part of WordPress security basics that feels the most technical, but it comes down to a short, specific list you can hand to a developer or work through yourself in under an hour.

1. Set directory permissions to 755 or 750, and file permissions to 644 or 640, avoiding 777 entirely since it makes files writable by anyone on the server.
2. Set wp-config.php to 440 or 400 so only the file’s owner can read it, since this single file contains your database credentials.
3. Move wp-config.php one directory above the web root where your hosting setup allows it, so it is not reachable through a browser at all.
4. Block browser access to .htaccess through server-level rules, since it can reveal configuration details if exposed.
5. Disable the built-in dashboard file editor by adding the DISALLOW_FILE_EDIT constant, which removes one of the easiest ways an attacker with admin access plants a backdoor.
6. Disable PHP execution inside the uploads folder, since that directory should only ever hold images and documents, never runnable code.

WordPress’s file permissions documentation lays out these exact modes and specifically warns against world-writable settings. If you are not comfortable making these changes directly, most managed hosts or a developer can apply them in under an hour, and it is worth keeping a note of the original permissions before you change anything in case a rollback is needed.

Add a Firewall, Monitoring, and Basic Detection

Prevention will not catch everything, which is why detection matters just as much. A web application firewall, known as a WAF, can sit at the network edge (blocking traffic before it reaches your server) or at the host level (filtering requests once they arrive). Edge WAFs tend to catch more volume and reduce server load, while host-based WAFs integrate more tightly with WordPress itself. Either approach buys you virtual patching, meaning known attack patterns get blocked even before you apply the official fix, plus rate limiting against brute-force attempts.

Beyond a firewall, a few low-effort monitoring habits catch problems early:

• Uptime monitoring that alerts you the moment your site goes down or responds unusually slowly.
• File-change monitoring that flags when core files, plugins, or themes are modified outside a normal update.
• Integrity checks comparing your live files against known-good versions.
• Centralized or host-provided logs you actually check periodically, not just collect.

A security benchmark for hardening WordPress recommends combining a firewall with file integrity monitoring and logging as a defense-in-depth approach, since no single control catches everything on its own. When something does look wrong, logs are your first source of evidence: unfamiliar IP addresses hitting the login page repeatedly, unexpected file modification timestamps, or new admin accounts you did not create are all indicators of compromise worth documenting immediately.

Pro Tip: If you only monitor one thing, monitor for new admin user accounts. It is one of the fastest ways to catch a breach before it escalates.

If your logs show a pattern you cannot explain, that is the moment to escalate to your host’s support team or a security professional rather than guessing.

The Security Audit and Recovery Checklist You Can Run Today

Everything above comes together in a repeatable audit. Set aside an hour, work through this in order, and repeat it monthly.

1. Run the Site Health tool built into WordPress to spot outdated PHP, missing HTTPS, or flagged issues.
2. List every active and inactive plugin and theme, noting version numbers, and delete anything unused.
3. Confirm your WordPress core and PHP versions are current and supported by your host.
4. Verify file permissions match the recommended modes: directories at 755/750, files at 644/640, wp-config.php at 440/400.
5. Test your latest backup by restoring it to a staging environment, not just confirming the backup job completed.
6. Confirm two-factor authentication is active on every admin and editor account.

If you suspect a site is already compromised, the sequence changes:

1. Document what you are seeing, including unfamiliar files, unexpected redirects, or new user accounts, as indicators of compromise.
2. Rotate every credential and secret key immediately, including wp-config.php secret keys, database passwords, and all admin logins.
3. Isolate the site by taking it offline or restricting access while you investigate, so the issue cannot spread or worsen.
4. Restore from a verified, known-good backup rather than trying to manually clean infected files, which often misses hidden backdoors.
5. Request server logs from your host, since they can help confirm how the attacker got in and whether other accounts were affected.

WordPress’s own guidance for hacked sites recommends this same sequence: document symptoms, rotate secrets, and test restores before bringing the site back online. Once you are back up, scan again to confirm the site is clean, check whether search engines flagged it as unsafe and request a review if so, and put a recurring reminder on the calendar so this audit becomes routine maintenance instead of a once-a-year scramble.

Why Trust This Guide

A digital agency builds and maintains websites for small and mid-sized businesses, with every service handled in-house rather than outsourced. Clients get a free digital audit and trial before signing anything, which covers exactly the kind of site health, plugin inventory, and backup checks outlined above.

Every control in this checklist maps directly to something a maintenance plan should be doing quietly in the background: managed updates, verified backups, uptime and file-change monitoring, and a documented recovery process if something does go wrong. This guide was prepared by Cristo for CloudSprout’s readers.

What to Prioritize This Month

If you only have a few hours this month, spend them here: update WordPress core and every plugin, create and verify an off-site backup, and turn on two-factor authentication for every admin account. Those three moves alone stop most automated attacks.

For the next 60 to 90 days, plan a bigger step: moving to managed hosting or adding an edge firewall if you are not on one already. If none of this fits your schedule, hiring help makes sense, but ask specifically what updates, backups, and monitoring the plan actually covers before signing anything.

— Cristo

Get a Free Site Audit Before Something Breaks

Working through this checklist alone takes real time, and most small-business owners have a business to run instead. Website development, hosting coordination, and ongoing maintenance can be handled entirely in-house, with month-to-month plans and no long-term contracts.

The free audit trial covers the fundamentals from this guide directly:

• A full site health scan checking WordPress core, PHP version, and plugin status.
• A plugin and theme inventory flagging anything outdated or abandoned.
• A backup verification check confirming your restore actually works.

From there, ongoing maintenance plans handle patching, monitoring, and backups on a recurring basis so this checklist runs itself instead of depending on a reminder in your calendar. You can see plan details on the pricing page or start with the free audit to see exactly where your site stands.

FAQ

What are the best security practices for WordPress?

The core practices are keeping WordPress core, plugins, and themes updated, using strong authentication with two-factor login, and maintaining verified off-site backups. Add secure file permissions, a firewall, and basic monitoring, and you cover the controls that stop most real-world attacks, as outlined in WordPress’s hardening guidance.

What are the most common security vulnerabilities in WordPress?

Most compromises trace back to outdated or abandoned plugins and themes, weak or reused admin passwords, and servers running unsupported PHP versions. Credential theft through stuffing or phishing is a leading way attackers gain initial access, according to security hardening research.

Does WordPress have security issues?

WordPress core itself is actively maintained and patched quickly when issues are found, but the platform’s popularity makes it a frequent target for automated scanning. Most real-world problems come from outdated plugins, weak passwords, or misconfigured hosting rather than flaws in WordPress core itself.

What is the best WordPress security plugin for 2026?

There is no single plugin that replaces good hosting, updated software, and strong login protection, since a plugin only adds a layer on top of those fundamentals. Look for one offering firewall rules, file integrity monitoring, and login protection together, and pair it with the hardening steps in this guide rather than relying on it alone.

How often should I run a WordPress security audit?

A monthly audit covering updates, backups, permissions, and account access catches most problems before they become incidents. Following the checklist outlined above on a recurring schedule keeps a site in a defensible state without requiring daily attention.

Recommended

• Prioritized Fixes for Small Business Website Speed Improvement
• $50–$150 Starter Website Maintenance Plan for Small Canadian Businesses