WordPress is popular, and so it is a constant target. Most compromises come from outdated plugins, weak passwords, and neglected sites, not from the core software itself.

Keep everything updated

– WordPress core, themes, and plugins

– PHP version on your server

Enable automatic minor updates, and apply other updates after testing, ideally on a staging copy.

Reduce what you run

– Delete unused plugins and themes (deactivated isn’t enough)

– Use reputable, actively maintained plugins

– Check when a plugin was last updated before installing

Protect logins

– Use strong, unique passwords and a password manager

– Enable multi-factor authentication for all administrators

– Limit login attempts

– Avoid the username “admin”

– Give users only the role they need

Harden the server

– Use HTTPS everywhere

– Choose reputable hosting with current software and isolation between sites

– Consider a web application firewall (WAF)

– Disable file editing from the dashboard

Back up properly

– Automatic daily backups of files and database

– Store copies offsite, outside the web server

– Test restores

Monitor

– Uptime monitoring

– Security scanning for malware and changed files

– Activity logs showing who changed what

Prepare for problems

Know who to call, how to restore a clean backup, and how to reset all passwords and keys if the site is compromised.

Privacy

If your site collects personal data, such as contact forms or analytics, keep your privacy policy current, as Quebec’s Law 25 requires.

DBR Soft offers WordPress hosting, maintenance, and security monitoring. Contact us for more information.