A website receives automated attacks every day; most are simple attempts, but a weak site can still be taken over. Basic measures remove most of the risk.
Keep it current
Software, theme and plugins should be current; most security holes come from old versions.
Strong passwords and permissions
A strong, different password for each user and, if possible, two-step verification. Close unnecessary admin accounts. Do not use the default “admin” username.
Reduce plugin count
Every plugin is an attack surface. Remove what you do not use. On sites with many plugins, risk and slowness rise together; see when do you need a WordPress plugin.
SSL and backups
Use https; see why you need an SSL certificate. Take regular backups kept elsewhere; see the website backup guide.
Clean out unneeded files
Forgotten backups, database dumps or configuration files in the root directory are a gift to attackers. Remove such files from the server or make them inaccessible from the web.
Attack monitoring
Watch for unusual requests in server logs. It is no surprise to see thousands of login attempts a month in a site’s access logs; rate limiting and blocking are needed.
The static site advantage
Static sites with no admin panel or database shrink the attack surface a lot. That is why the new version of this site was built this way.
Security is part of our hosting and domains service. For a new site see our web design service.