Harden WordPress before an incident: beyond installing one security plugin

Many businesses take security seriously one day after an incident: the home page changes, spam leaves the server, or an unknown administrator appears. Installing one more security plugin is not a complete answer then. The entry point, scope of change and last healthy state all need evidence.

Reduce the attack surface

Remove unused plugins and themes rather than merely deactivating them. Use trusted sources and keep administrator privileges limited to people who genuinely need them.

Give each person an individual account, strong credentials and multi-factor authentication. A shared admin account destroys accountability and makes offboarding risky.

Make updates a controlled process

Back up before changes, test in staging or a low-risk window, and verify critical journeys afterwards. Long delays expose known issues, while untested updates may interrupt service.

Log and alert on file changes, failed logins, new administrators and plugin changes. Without visibility, the gap between compromise and discovery grows.

Prepare for an incident

Maintain a healthy off-server copy, an access inventory and instructions for invalidating sessions. Contain first, preserve evidence and identify the entry point; restoring without closing it only buys time.

Controls should match risk. Shops and membership sites need stricter measures than a quiet brochure, but every site needs access discipline and recoverable backups.

Monthly review

• Core, themes and plugins are reviewed.
• Admin accounts and privileges remain necessary.
• The backup is healthy and restorable.
• Login and file-change alerts are active.
• Forms, uploads and APIs are checked for abuse.

Official reference: Hardening WordPress guidance