How to Secure Your Business WordPress Site: The Checklist

A custom millwork shop in Montréal's West Island had its WordPress site built in 2019. Nobody has really touched it since: 23 plugins, seven of them deactivated, one "admin" account shared with the former agency, and a quote request form that collects names and phone numbers.

One Monday morning, a client calls: the site is sending him to a fake online pharmacy. And for weeks, the form had been quietly copying every request to an unknown address.

The story is fictional, but every cause in it is ordinary. WordPress's official documentation and the Canadian Centre for Cyber Security describe simple measures any small business can apply.

Why business WordPress sites get hacked

A WordPress site is rarely targeted personally: bots sweep the internet looking for vulnerable plugins, weak passwords and poorly protected login pages, and your site simply gets caught in the net.

In its ITSM.60.005 guidance, the Canadian Centre for Cyber Security puts it plainly: the more plug-ins you have, the greater your attack surface, especially if they aren't official. And according to WordPress, older versions no longer receive security updates.

Your site is more than a brochure. If it collects personal information (forms, newsletter sign-ups, an online store), a compromise can become a privacy incident. In Quebec, Law 25 calls this a confidentiality incident (s. 3.6); elsewhere in Canada, federal or provincial privacy law sets its own rules.

The WordPress security checklist

Here are 14 checks drawn from WordPress's "Hardening WordPress" guide and the Cyber Centre's ITSM.60.005.

Updates

• WordPress core is on the latest version.
• Automatic updates are on for plugins and themes, or a named person applies them every week.
• Unused plugins and themes are deleted, not just deactivated.
• Your host runs a PHP version that's still supported.

Accounts

• Everyone has their own account; no "admin" account and no shared logins.
• Two or three administrators at most; everyone else is an Editor or Author.
• Two-factor authentication is mandatory for every administrator.
• Agency and freelancer access is named and removed when the contract ends.

Protection and configuration

• A web application firewall (WAF) filters traffic.
• Login attempts are limited, and xmlrpc.php is disabled if you don't use it.
• The dashboard file editor is disabled.
• The site runs on HTTPS, and your host offers SFTP rather than FTP.

Backups and monitoring

• Backups are automatic, stored in more than one place, and a restore has been tested.
• Logs and failed login attempts are monitored.

Updates: closing known holes

Turn on automatic updates for plugins and themes: it's the simplest way to fix known vulnerabilities before a bot finds them.

Since WordPress 5.5, administrators can enable them plugin by plugin (Plugins screen) and theme by theme (Appearance screen). According to WordPress's documentation, they run twice a day by default, and the site owner gets an email after each attempt, successful or not. Automatic updates for core have existed since version 3.7.

Three precautions:

• Back up first. The documentation recommends making sure you can roll back to a previous version.
• Clean house. A deactivated plugin is still on your server, so delete it. On a plugin's WordPress.org page, check when it was last updated; an abandoned plugin won't get any more fixes.
• Check PHP. WordPress recommends PHP 8.3 or later and notes that older releases, such as PHP 7.4, have reached their official end of life.

For an online store, test major updates on a staging site first. Our article on patch management policy suggests timelines based on severity.

Accounts and login: 2FA, roles and the login page

WordPress core doesn't ship two-factor authentication: its official documentation recommends adding it for all administrators and other privileged users, through a reputable plugin or your identity provider.

The Canadian Centre for Cyber Security highly recommends multi-factor authentication for all types of accounts, and WordPress mentions passkeys, which resist phishing. Then:

• No "admin" username. WordPress's documentation advises against it: create a named administrator account, then demote or remove the old one.
• Few administrators. Posting news only takes the Editor role.
• Limit login attempts. WordPress recommends doing it at the edge (a WAF or content delivery network) or at the web server. Hiding the login URL reduces noise, but it shouldn't be your only defence.
• Disable XML-RPC if you don't use it. According to the same documentation, xmlrpc.php is a frequent target of brute force attacks.

Web application firewall, hosting and configuration

A web application firewall (WAF) sits between your site and the internet to filter malicious requests; the Canadian Centre for Cyber Security recommends installing one and notes it can act as a short-term stopgap until a patch is applied.

It can be a cloud service in front of your site (a reverse proxy), your host's WAF or a security plugin. The first two block traffic before it reaches your server, which WordPress prefers against large-scale login attacks. Start by asking your host what's already included.

On the configuration side, the WordPress hardening guide suggests, among other things:

• adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php to disable the dashboard's PHP file editor;
• restricting permissions: 755 for directories, 644 for files, 400 or 440 for wp-config.php;
• using SFTP rather than FTP, and HTTPS for administration.

While you're at it, check your site's HTTP security headers with our security headers checker.

Backups and monitoring: plan for the worst

A backup only counts if you know you can restore it: the Canadian Centre for Cyber Security says to test backups rigorously to make sure they work.

WordPress's documentation suggests weekly backups for a small, low-activity site and daily backups for a busy one, keeping at least three to five recent copies in different places (your host, a cloud service, a local computer). Also keep copies old enough to go back before a compromise nobody noticed.

The Cyber Centre also recommends analyzing logs and monitoring failed login attempts. In practice: an alert for every new administrator login, and a monthly look at the Site Health tool (under Tools).

If a site that collects personal information is compromised, record the event and assess the risk of harm. Under Quebec's Law 25, that means your incident register and an assessment of the risk of serious injury; confirm your obligations with legal counsel.

Testing your site: scan or penetration test?

For a brochure site with no sensitive data, regular vulnerability scanning is often enough; once the site handles payments, client accounts or personal information, a web application penetration test becomes worthwhile.

Our comparison of pentests, scans, bug bounties and red teams explains what each approach finds. A penetration test requires written authorization from the system owner (Criminal Code, s. 342.1); if your site is hosted by a third party, also check its terms of service.

Too many unchecked boxes? Our remediation and hardening service can clean things up alongside your web agency, and a free consultation helps you decide where to start.