The handful of controls that prevent the overwhelming majority of WordPress compromises.
WordPress is not inherently insecure. It is the most common target, and the overwhelming majority of compromises come through a small number of well-known doors.
Outdated plugins are the main entry
Almost every incident traces to a known vulnerability in a plugin or theme that had a patch available. Keeping core, plugins and themes current, and removing anything deactivated but still installed, closes most of the risk before anything else is configured.
Accounts and access
Enforce strong passwords, add two-factor authentication for anyone with publishing rights, limit login attempts, and give each person the lowest role that lets them do their job. Shared administrator logins make an incident impossible to investigate afterwards.
Reduce what is reachable
Disable file editing from the dashboard, block direct execution of PHP in the uploads directory, keep XML-RPC off unless something needs it, and put a firewall in front of the site. Each removes a class of attack rather than a single exploit.
Then assume something will still get through: take offsite backups, test a restore at least once, and keep a log of who changed what. Recovery time is a security control too.
Want this for your business?
Let's talk about how we can help you build and grow.
