Create an evidence-based WordPress security baseline and recurring review rather than install one plugin and assume protection.
WordPress security is ongoing risk reduction across people, credentials, code, hosting, data, monitoring, and recovery. A security plugin can support controls, but it cannot compensate for abandoned extensions, shared administrator access, or an untested restore path.
Define the site and its highest-impact failures
Inventory domains, hosting, WordPress instances, environments, owners, privileged users, themes, plugins, integrations, payment or form data, backups, and recovery contacts. Rank loss scenarios such as account takeover, malicious code, data exposure, payment redirection, defacement, and destructive deletion so controls address the actual service.
Establish a defensible baseline
- Supported PHP, WordPress core, theme, and plugin versions
- Unique accounts, least privilege, MFA, and current recovery methods
- HTTPS, protected secrets, appropriate file permissions, and restricted administrative paths
- Off-site backups with a recent isolated restore test
- Security and error logging with named alert ownership
- Documented update, incident, containment, and recovery procedures
Separate preventive, detective, and recovery controls
| Control type | Purpose | Evidence |
|---|---|---|
| Prevent | Reduce likelihood or access | Versions, roles, MFA, configuration |
| Detect | Reveal suspicious change or behavior | Alerts, logs, file or account review |
| Recover | Restore trusted operation | Verified backup, runbook, clean credentials |
Improve security in a safe order
- Back up and prove restoration.
- Remove unknown or unused privileged access.
- Update supported components through staging.
- Replace abandoned or unnecessary extensions.
- Configure proportionate monitoring and alerts.
- Run a short incident exercise with named owners.
Avoid security theater
- Changing login URLs while leaving weak administrator access
- Installing overlapping security plugins without ownership
- Blocking legitimate automation, checkout, or accessibility paths
- Keeping compromised backups as the only recovery option
Review the baseline after every material change
Record the owner, current state, last evidence date, exception, next action, and review frequency for each control. Recheck after hosting, domain, staff, plugin, payment, authentication, or deployment changes. Security is credible when another authorized person can verify the controls and execute recovery.
Continue with the next decision
Sources and further reading
Primary and contextual sources used to verify definitions or give readers a relevant next resource.
- WordPress hardening handbook Official WordPress guidance on risk reduction across updates, passwords, HTTPS, file permissions, plugins, backups, logging, and monitoring.