WordPress Security: How to Protect Your Business Website

WordPress itself is not insecure. But a WordPress website that has not been updated in six months, uses one shared admin login with a weak password, has 15 unused plugins installed and has never been backed up is a risk. The platform is not the problem. The maintenance is.

This guide covers the most common ways WordPress sites get compromised and the practical protections that reduce that risk. It is written for business owners, not developers. If you want the full picture of what happens after a website launches, our web design pillar guide covers everything from maintenance to ongoing performance. This article focuses specifically on security.

The Straight Answer: WordPress Security Depends on How the Website Is Managed

Most small businesses should focus on six layers of protection:

1. Keeping WordPress, themes and plugins updated

2. Protecting administrator accounts with strong passwords and two factor authentication

3. Limiting who has administrator access

4. Using reputable hosting with firewalls, SSL and backups

5. Monitoring for suspicious activity

6. Maintaining off site backups with a tested recovery plan

WordPress security is less about making a website impossible to attack and more about making it harder to compromise, easier to monitor and faster to recover.

The Australian Cyber Security Centre at cyber.gov.au recommends MFA, software updates and backups as three foundational measures for small businesses. Those same priorities apply directly to protecting a WordPress website.

Is WordPress Insecure?

WordPress is the most widely used content management system in the world, which makes it a common target. But being targeted is not the same as being weak. Attackers frequently go after exposed login pages, weak passwords, outdated plugins, abandoned themes and poorly secured hosting, not flaws in the core WordPress software itself.

A neglected WordPress site is much riskier than a maintained one. Plugin updates ignored for months, unused themes left installed, former staff retaining access, one shared admin login with no two factor authentication, no backups and no monitoring, that combination creates the risk, not the platform.

A different platform does not remove security responsibility either. Even fully hosted platforms still require strong account security, MFA, safe integrations and controlled permissions. If you are weighing whether WordPress is the right choice, our guide on WordPress pros and cons in 2026 covers the broader decision.

How WordPress Websites Commonly Get Compromised

The common thread is that most compromises exploit maintenance gaps, not flaws in WordPress core. Cyber.gov.au notes that phishing often directs people to fake websites designed to collect account credentials. MFA is one of the most effective protections against unauthorised access, even when credentials are stolen.

How to Secure a WordPress Business Website

1. Keep WordPress, themes and plugins updated

WordPress, the active theme and every installed plugin each need updates. Outdated software is one of the most common entry points. Review updates regularly, back up before significant changes, use staging for complex sites and confirm the website still works after updating. WordPress allows administrators to opt individual plugins and themes into automatic updates, which can work well for simple brochure sites with reliable backups. For WooCommerce, membership sites or complex integrations, manual or staged updates are usually safer.

2. Use strong, unique passwords

Apply unique passwords to WordPress users, hosting, domain registrar, business email, databases, SFTP and backup accounts. Use a password manager. Do not reuse passwords. Cyber.gov.au recommends strong passphrases of four or more random words and identifies MFA as one of the most effective protections against unauthorised access.

3. Turn on two factor authentication

This is the single highest impact step most small businesses can take. WordPress core does not currently include native 2FA, so it needs to be added through a reputable plugin, hosting platform or identity provider. Prioritise 2FA for administrators, developers, agency accounts, hosting, domain registrar and business email. Use an authenticator app or security key and store recovery codes somewhere secure and separate from the website login.

4. Limit user access

Give each person the lowest access level they need. Administrator only where essential. Editor for content managers. Author for individual writers. Remove dormant accounts. Use separate named accounts for each person and never share one admin login across the team. Review all users quarterly: who still needs access, does each person need admin rights, are former employees still listed?

5. Choose secure, well supported hosting

A good host should offer maintained server software, malware scanning, firewall protection, account isolation, automatic backups, SSL, SFTP, PHP updates and responsive support. WordPress identifies the hosting environment as a fundamental part of security and notes that businesses need to understand where the host's responsibility ends and their own begins. For a comparison of options, see our Australian WordPress hosting guide.

6. Use HTTPS across the entire website

HTTPS protects data while it travels between the visitor and the website. Check for a valid SSL certificate, HTTP redirecting to HTTPS, no mixed content warnings and WordPress Address and Site Address both using HTTPS. The padlock icon does not mean the website is malware free. It only confirms an encrypted connection to the domain.

7. Install a security plugin carefully

A security plugin can add useful controls: login protection, malware scanning, file change alerts, firewall functions, activity logs and vulnerability warnings. But a security plugin supports a security plan. It does not replace updates, backups, good hosting or access control. Do not install several overlapping security plugins. Pick one reputable option, configure it properly and test.

8. Remove unused plugins and themes

Deactivating software is not always enough. Remove unused plugins, abandoned themes, old staging tools, duplicate optimisation plugins and inactive integrations. Keep the active theme, one current default WordPress theme for troubleshooting and only plugins with a clear purpose. Every extra plugin is another component that needs updates, monitoring and compatibility testing.

9. Protect forms and public entry points

Forms can attract spam, bots, malicious uploads and repeated submissions. Use bot detection, CAPTCHA, upload restrictions, file type validation, rate limiting and spam filtering. Also review comments, account registration, password reset, XML RPC (disable if unused) and API integrations. If your forms need a broader usability review, our guide on contact form best practices covers how to balance security with conversion.

Your Backup Is the Last Line of Defence

Cyber.gov.au recommends regular or automatic backups because they may be essential for restoring information after a cyber incident. WordPress's backup documentation says both the database and website files need to be protected so the site can be restored after loss or corruption.

What a backup should include

The database (pages, posts, settings, users, form data, ecommerce data) and the files (images, themes, plugins, uploads, custom code, configuration). Both are needed for a complete restore.

How often should you back up?

• Basic brochure site: Daily or weekly, depending on update frequency

• Active service website: Daily

• Frequently updated blog: Daily

• Ecommerce store: Real time or multiple times daily

• Membership or booking site: Real time or frequent incremental backups

Store backups away from the live website

Do not keep the only backup on the same hosting account or inside the live WordPress installation. Use separate cloud storage, an independent backup service or a combination of host backup and off site storage.

Test the restore process

A backup is not fully useful until the business knows it can be restored. Test whether the backup opens, whether database and files are included, whether a staging restore works, how long recovery takes and who has restore access. This is one of those website costs businesses often miss, both the cost of proper backup tooling and the cost of not having it when something goes wrong.

Monitor the Website Instead of Waiting for Customers to Tell You

Use uptime monitoring, login alerts, file change alerts, malware scanning, backup failure alerts, plugin vulnerability notifications, form delivery monitoring and Search Console security alerts. Alerts need an owner. Define who receives them, who checks them, what counts as urgent and who can contact the host or restore a backup. For help with analytics and monitoring setup, see our guide to what to track on your website.

A Practical WordPress Security Maintenance Schedule

Factor these tasks into your ongoing WordPress maintenance costs. Whether you handle maintenance in house or through a provider, security tasks need an assigned owner and a regular cadence. If you are setting up a new WordPress site, run through our website launch checklist to make sure security basics are covered from day one.

What to Do if You Think Your WordPress Site Has Been Hacked

Warning signs include unknown administrator accounts, unexpected redirects, spam pages appearing in Google, browser security warnings, changed homepage content, unexplained files, hosting suspension or customers receiving suspicious emails.

Step 1: Do not start randomly deleting files

Random changes can destroy evidence, make diagnosis harder, break the site further and leave hidden access in place.

Step 2: Contact the host or security provider

Ask the host to isolate the site if needed, inspect logs, scan the account, identify affected sites and provide a clean restore point.

Step 3: Reset relevant credentials

Change WordPress admin passwords, hosting passwords, SFTP credentials, database credentials, domain registrar password and business email passwords. Enable MFA where it was missing.

Step 4: Identify the entry point

The cause is usually a vulnerable plugin, outdated theme, stolen credentials, compromised device or insecure hosting account. Do not simply restore the site without fixing the original entry point or the compromise may recur.

Step 5: Restore or clean the site

Depending on the incident: restore from a known clean backup, replace compromised WordPress files, remove malicious users and code, update the full stack and rotate security keys and credentials.

Step 6: Check reporting and legal responsibilities

Australian businesses can report cybercrime through ReportCyber and seek help through the Australian Cyber Security Hotline. Data exposure may create privacy or notification responsibilities under Australian law. The OAIC provides guidance on data breach notification requirements. Get professional legal or privacy advice if personal information may have been affected.

Who Is Responsible for WordPress Security?

Responsibility is usually shared between the business owner, hosting provider, web developer or maintenance agency and any internal marketing or IT team. But it must be documented. Ask:

• Who performs updates?

• Who confirms backups are running?

• Who monitors security alerts?

• Who tests restores?

• Who renews SSL and the domain?

• Who responds after hours?

• Is malware cleanup included in the maintenance agreement?

• What happens if an update breaks the site?

If nobody can answer these questions clearly, that is the security gap to fix first. If you are planning a new site or rebuild, our website redesign checklist includes security handover tasks to address during the project.

WordPress Security Checklist for Small Businesses

Accounts

• Unique passwords used for every account

• Password manager in place

• 2FA enabled for all administrators

• Separate accounts for each user (no shared logins)

• Former users and old agency accounts removed

• Administrator access restricted to those who genuinely need it

• Recovery codes stored securely and separately

Software

• WordPress core updated

• Active theme updated

• All plugins updated

• Unused plugins removed (not just deactivated)

• Unused themes removed

• Plugins sourced only from trusted providers

• Abandoned or unsupported plugins replaced

Hosting and connection

• Reputable host with firewall and malware scanning

• SSL certificate active and valid

• HTTPS enforced across the entire site

• SFTP used instead of plain FTP

• Supported PHP version running

• Server software maintained by the host

Backups and recovery

• Automated backups running (database and files)

• Backups stored separately from the live server

• Retention period understood

• Restore process tested at least quarterly

• Recovery owner assigned and documented

Monitoring

• Uptime monitoring enabled

• Suspicious login alerts configured

• Security scans running regularly

• Failed backup alerts reviewed

• Form delivery monitored

• Incident contacts documented

For a broader health check beyond security, our DIY website audit covers clarity, speed, mobile, CTAs, trust and tracking alongside security basics.

Common WordPress Security Mistakes

• Ignoring updates for months. Every unpatched plugin is a potential entry point. Set a monthly update schedule at minimum.

• Using one shared administrator login. If one set of credentials is compromised, every person using that login is affected. Use separate named accounts.

• Installing plugins from untrusted websites. Pirated or "nulled" premium plugins can contain hidden malware, backdoors or data stealing code.

• Giving every user administrator access. Most team members only need Editor or Author access. Admin should be reserved for those who genuinely need it.

• Keeping unused plugins and themes. Deactivated software can still contain vulnerabilities. Remove what you do not use.

• Assuming SSL means the site is completely secure. HTTPS encrypts the connection. It does not protect against weak passwords, outdated software or compromised accounts.

• Keeping the only backup on the live server. If the server is compromised or fails, the backup goes with it. Store backups off site.

• Never testing whether a backup can be restored. A backup that cannot be restored is not a backup. Test quarterly.

• Protecting WordPress but ignoring email and hosting accounts. A compromised email or hosting account can reset WordPress access entirely. Protect the full chain.

• Restoring a hacked site without finding the entry point. If the vulnerability is still there after the restore, the compromise will likely recur.

What We Recommend at Elev8d

Most small businesses do not need an enterprise grade security stack. They need the fundamentals handled consistently: updates, MFA, controlled access, reputable software, secure hosting, reliable backups, monitoring and a documented recovery process.

A security plugin can help, but it cannot compensate for a website that has been neglected for years. The safest setup is the one where everyone knows who maintains the site, who receives alerts, where backups are stored and what happens if something goes wrong.

If you are moving to WordPress from another platform and want to start with a clean, secure foundation, our guides on Wix to WordPress migration and Squarespace to WordPress migration both cover security setup as part of the migration process. And if speed issues are also a concern, our guide on WordPress performance problems covers the overlap between performance and security.

FAQs

Is WordPress secure for a small business website?

Yes, when it is maintained properly. WordPress can be operated securely with regular updates, strong passwords, two factor authentication, reputable hosting and reliable backups. Risk increases when the site is neglected.

Why do WordPress websites get hacked?

Usually because of weak passwords, outdated plugins or themes, excessive administrator access, untrusted software or compromised hosting and email accounts. Most compromises exploit maintenance gaps, not flaws in WordPress core.

Do I need a WordPress security plugin?

A security plugin can add useful features like login protection, malware scanning and activity logging. But it is one layer, not a complete solution. It does not replace updates, backups, strong passwords and controlled access.

Does WordPress include two factor authentication?

WordPress core does not currently include native 2FA. It needs to be added through a reputable plugin, hosting platform or identity provider. This should be one of the first things configured after installation.

How often should I update WordPress plugins?

Review updates at least monthly. For simple sites with reliable backups, automatic updates for reputable plugins can work well. For complex sites, test updates on staging first.

How often should a WordPress website be backed up?

Daily for most active business websites. Real time or multiple times daily for ecommerce, booking or membership sites. Weekly may be adequate for simple brochure sites that rarely change.

Where should WordPress backups be stored?

Away from the live hosting account. Use separate cloud storage, an independent backup service or a combination of host level backup and off site storage.

How do I know if my WordPress site has been hacked?

Warning signs include unknown admin accounts, unexpected redirects, spam pages in Google search results, browser security warnings, changed content, unexplained files, hosting suspension or customers reporting suspicious emails.

What should I do after a WordPress security breach?

Do not delete files randomly. Contact the host. Reset all relevant credentials. Identify the entry point. Restore from a clean backup or professionally clean the site. Enable MFA everywhere. Review reporting obligations if personal data was affected.

Is my hosting provider responsible for WordPress security?

Partially. The host is usually responsible for server infrastructure, firewall and account isolation. The business or its maintenance provider is responsible for WordPress updates, user access, plugin management, backups and monitoring. Responsibility should be documented clearly.

Does HTTPS protect my website from hackers?

HTTPS encrypts the connection between the visitor and the website. It does not protect against weak passwords, outdated plugins, compromised accounts or malware on the server. It is essential, but it is only one layer.

Next Steps: Pick Your Path

• Not sure if your site is secure? Run through the security checklist above. Focus on 2FA, updates and backups first.

• WordPress feels neglected? Set up a monthly maintenance schedule. If you do not have time, hire a maintenance provider and document responsibilities.

• Think the site may be compromised? Contact your host immediately. Do not start deleting files. Follow the hacked site response steps above.

• Planning a new WordPress site? Talk to Elev8d about building a secure WordPress website with proper security, backups, monitoring and maintenance baked in from day one.

• Want to compare platforms? Use our website platform comparison tool to see how WordPress compares on security, flexibility and maintenance.

Sources and Further Reading

• Australian Cyber Security Centre - Small Business Guide - Foundational cyber security guidance including MFA, passphrases and backups

• WordPress Hardening Guide - Official WordPress security hardening documentation

• OAIC - Notifiable Data Breaches - Australian data breach notification requirements for businesses

• Australian Government Digital Service Standard - Guidance on secure, accessible digital services

• ReportCyber - Australian Government cybercrime reporting portal

General information only. This is not legal, privacy, incident response or cybersecurity advice for a specific business. Rules vary by situation, particularly around data breach notification, privacy, advertising claims and consumer law. If you are unsure about compliance or experience a security incident involving personal data, get professional advice.