WordPress Security Basics Every Owner Should Set Up

Owners of small business websites often say the same thing when security comes up: “Who would bother hacking us? We are not a bank.”

Nobody has to bother. Most attacks on WordPress are run by scripts that try thousands of sites a night, looking for an old plugin or a weak password. They do not know or care what your business does. They want your server to send spam, your Google rankings to push fake pages, or your visitors to send somewhere else.

You do not need to become a security expert to stop them. You need a few things set up properly, and a clear answer to who looks after each one. That is what this lesson covers. The technical steps for your developer are in our guide on how to harden WordPress; here we stay at the level of decisions an owner makes.

01Who Owns the Updates?

Out-of-date plugins are the most common way into a WordPress site. Not WordPress itself, which installs its own minor security releases automatically, but the gallery plugin or form add-on nobody has looked at since launch.

So the first security decision is not a setting. It is a name. Somebody, you, a staff member or your developer, checks for updates every week and applies them. As of November 2026, WordPress is on version 7.1.4, and the Dashboard shows an Updates screen with anything waiting. If nobody owns that screen, the site drifts back to vulnerable within months.

While you are there, delete plugins and themes you do not use. Switched-off code is still code on your server. And look at when each plugin was last updated by its makers. One that has not changed in years is a plugin nobody is fixing.

02How Should Logins Be Set Up?

Bots try passwords against your login page all day. Four habits make that a waste of their time.

• No “admin” username: it gives away half the login. Every account should have a name an outsider could not guess.
• Long, unique passwords: from a password manager, never reused from email or banking. A reused password leaks with the weakest site you used it on.
• Two-factor login: a code from a phone app as well as the password. Free security plugins offer it.
• Limited attempts: after a few failed tries the address gets blocked for a while.

Make two-factor compulsory for everyone who can change the site, not just available.

Optional two-factor is not two-factor.

The one person who skips it becomes the way in. What about moving the login page to a secret address? It is worth doing, because it cuts the noise of bots hitting your login all day and keeps your logs quieter. Just treat it as a curtain, not a lock. The four habits above do the real work.

03Which Role Should Each Person Have?

WordPress has roles for a reason. Give each person the lowest one that lets them do their job, so a stolen login can do as little damage as possible.

One login per person, never shared. Picture the user list of an immigration consultancy in Chandigarh three years after launch:

“office” Administrator, password shared by four counsellors — “designer” Administrator, the freelancer who built the site and left — a counsellor who writes visa updates, also Administrator — Fix: a personal login each, Editor or Author for counsellors, the old accounts deleted today

Nobody did anything wrong on purpose. The list just grew. For a consultant whose enquiry form collects names, phone numbers and visa histories, it is also exactly the kind of loose end that turns into a breach. When someone leaves, remove their login the same day you take back their office keys.

04Do You Need a Firewall?

For a business site, yes. A firewall blocks known attack patterns before they reach WordPress. There are two kinds, and they work well together. A plugin firewall such as Wordfence runs inside WordPress and knows about plugin weaknesses. A network firewall such as Cloudflare sits in front of your hosting and stops bad traffic before it uses up your plan’s resources.

Pick one security plugin, not three. Several security plugins fight each other and slow the site, which undoes the work from the speed lesson. And send its alerts to an inbox somebody actually reads. An alert that lands in a forgotten mailbox protects nobody.

05Who Should Own the Hosting, Domain and Email?

This is the part owners skip, and it matters as much as anything inside WordPress. Whoever controls your hosting panel, your domain account and the email address that resets them controls your website.

Those accounts should be in the business’s name, tied to an email address the business owns, with two-factor login switched on. Your developer gets their own access, not your password. If a developer or agency holds the only login to your domain, ask today for it to be moved to you. It is a polite request and any good developer will do it.

One more thing to know about shared hosting. If several websites sit in the same hosting account, a problem on one can spread to the others, because they share the same files and user. An old test site or a relative’s blog in the same account is a risk to your business site. Move it out or delete it.

06What Should You Ask Your Developer to Set Up?

You do not have to do the technical work yourself. You do have to know it was done. Ask whoever builds or looks after your site to confirm these in writing:

• The dashboard’s built-in file editor is switched off.
• Code cannot run from the uploads folder, where attackers usually try to drop files.
• File permissions and the configuration file are locked down.
• The PHP version is one that still gets security fixes.
• File change alerts are on, so a changed file emails someone.
• Automatic backups are stored away from the server.

Each of those is explained step by step in the hardening guide linked above. If your developer cannot say yes to them, that tells you something. Security setup is part of every site we build under our WordPress development work, and we are happy to check an existing site against the same list.

07How Do You Know It Is Still Working?

Security is not a job you finish. Once a month, spend ten minutes on four checks: the user list has only people you can name, nothing is waiting on the Updates screen, the security plugin has not been sending alerts nobody read, and Google Search Console shows nothing under Security issues. Module 5 turns this into a proper monthly checklist.

08What Comes Next?

All of this lowers the odds of trouble. None of it brings them to zero. The next lesson covers the one safety net that always works: backups you can actually restore, what to back up, where to keep it, how often, and how to test it before you need it.