How do you secure WordPress preventively?

Securing WordPress preventively does not begin with a list of tools, but with understanding where the risk actually lies. Most hacks do not come via a weakness in WordPress itself, but via what has been added around it and is not maintained. Anyone who recognises that chooses different measures than someone working through a tick-box list.

The questions that matter in practice are straightforward: when were your plugins last updated, and do your backups actually work.

Where the risk actually lies

In our practice, an outdated plugin has been the access route in approximately 75 per cent of cases. In addition, outdated passwords occur and FTP passwords that have not been changed for a long time.

The vulnerabilities that hackers exploit are almost always in the plugins, themes and access credentials that you manage. Or rather: that you should be managing, but where attention fades once the site is up and running.

This means that preventive security is largely a maintenance question, not a tooling question. Installing an additional security tool without having the maintenance in order shifts attention rather than risk.

If you want to understand why WordPress sites get hacked and which patterns recur, that article covers the background in more detail.

What prevention concretely requires

Prevention is not a one-off action. Below are the areas that matter in practice, with the considerations that come with them.

Updates: automatic or manual?

Some hosting providers enable automatic updates by default. We disable them and update manually, because every update can break the site. Without a staging environment you shift the risk from being hacked to breaking down.

Manual updating requires someone who actively monitors whether an update is stable enough. The question is not whether automatic is unsafe, but who assesses it and what happens if it goes wrong. If no one assesses it, automatic is better than nothing. If someone does assess it, manual is the better choice.

More about WordPress maintenance and updates is covered in the articles that fully address that topic.

Backups: an assumption or a provision?

Nearly everyone has backups. Hardly anyone has ever restored them. And that is precisely the problem: a backup that has never been restored is an assumption, not a provision.

During an infection it may emerge that the backup is incomplete, or that the infection is already in it at the point you restore. Backups belong with your hosting provider, who can automate them and be held accountable for them. Knowing how restoration works and how quickly it can happen is part of that.

Security plugins: installation versus configuration

A properly configured security plugin such as Wordfence adds value. A plugin installed with default settings does less than you think. It is about the configuration, not the installation.

Multiple security plugins running simultaneously is a common mistake, usually because no one dares to remove the previous one. They conflict, produce duplicate or false alerts, and cost performance. More security here delivers less security.

For the broader consideration between tooling and configuration, read the article on WordPress security plugins versus hardening.

Access and passwords

Two-factor authentication is one of the simplest measures with the greatest impact. For accounts with administrative privileges, this is one of the first things to consider.

A less obvious point of attention: the client themselves is an admin and can thereby unintentionally cause damage. In our practice, a client built their own plugin that brought down the site. By agreement, access can be restricted. The consideration is how much freedom someone needs versus how much damage they can cause.

Monitoring

Monitoring that immediately alerts your development team when something breaks, including on the hosting side, is a component of prevention that is often missing. Not everything is caught by it. But the major issues usually are, and early enough to act.

The limits of prevention

No combination of measures rules out a hack. That is not a reason to do nothing, but it is the basis for realistic expectations.

What prevention does do: reduce the chance that someone gets in, and limit the damage because you catch it early and know what to do. Early detection and swift action are worth as much as the measures themselves. If you are hacked regardless, the article what to do when your WordPress site has been hacked describes the next step.

Maintenance as a structural choice

Structural maintenance takes two forms in practice. Periodic maintenance covers updates and database optimisation, one to three times per month depending on what a site requires. An SLA adds to that the assurance that in the event of an emergency, action is taken within four hours. Not every site is suited to the latter.

A complete picture of security and recovery can be found on the page WordPress security and recovering a hacked site. How we arrange maintenance for clients is described at our WordPress support.

The question is not whether you take security seriously, but who actually keeps on top of it. If that is no one, that is the risk. Who actually maintains your site, what happens if an update breaks the site, and when is this work that you no longer want to do yourself?

Frequently asked questions

Can you prevent your WordPress site from being hacked? Complete prevention is not possible, but you can significantly reduce the chance and limit the damage by detecting early and acting quickly. Prevention is about maintenance, access management and monitoring, not a one-off configuration.

Is a security plugin enough to secure your site? No. A security plugin is one component of security, not a complete solution. Without up-to-date plugins, strong passwords, working backups and active maintenance, a security plugin provides a false sense of security.

Should you enable automatic updates in WordPress? That depends on who assesses them and what happens if an update breaks the site. Without a staging environment and without someone who assesses updates, manual updating is riskier than automatic. With active management, manual is the better choice.

How often should WordPress be updated? In our practice, maintenance takes place one to three times per month, depending on what a site requires. WordPress core, plugins and themes all need to be included in that cycle.

Do you need a backup if you have good security? Yes. A backup is not an alternative to security, and security is not an alternative to a backup. A backup that has never been restored is an assumption, not a provision.

Who is responsible for security: you, your agency or your hosting provider? The responsibility is shared but not equally divided. The hosting provider manages the server environment and backups. Whoever handles the maintenance, whether that is an agency or you yourself, manages updates, configuration and monitoring. You manage your own access credentials. If any of the three parties does not do their part, it has consequences for the whole.