WordPress Security Checklist for UK Small Businesses (2026)

WordPress powers a huge share of UK business websites. That popularity is a strength (talent, plugins, hosting) and a risk (bots try the same doors on every site). Good news: most compromises still come from boring failures — outdated plugins, weak admin passwords, abandoned themes — not Hollywood zero-days. This checklist is written for owners and managers who want a site that stays online, keeps customer data safe, and does not become a weekend emergency.

You do not need to become a security engineer. You need a short list of habits, the right hosting basics, and a recovery plan you have actually tested once.

1. Own the update rhythm

Outdated core, themes and plugins are still the number one everyday risk. Treat updates like bookkeeping: regular, boring, scheduled.

• WordPress core — apply minor security releases promptly; major versions on staging first if you have custom code.
• Plugins — update monthly at minimum; critical security patches within days.
• Themes — keep the parent theme current; put custom work in a child theme so updates do not wipe your design.
• PHP version — run a currently supported PHP release (8.1+ as a floor in 2026; prefer 8.2/8.3 on good hosts).

On managed WordPress hosting, enable automatic minor updates for core. Still review plugin changelogs when a plugin powers checkout, memberships or forms.

# Example WP-CLI health pass (SSH on capable hosts)
wp core check-update
wp plugin list --update=available
wp theme list --update=available
wp core verify-checksums

2. Lock down logins like they matter (they do)

Brute-force bots never sleep. Your admin login is a front door with a neon sign if you leave defaults in place.

• Use a unique, long password (password manager, not “Company2024!”).
• Turn on two-factor authentication for every administrator.
• Never share one “Admin” login; give each person their own user with the least privilege they need.
• Change the display name so the public author name is not the login username.
• Limit login attempts (host firewall, security plugin, or server rules).

Avoid the cargo-cult of only “hiding wp-admin”. Obscurity helps a little; strong credentials and rate limits help a lot. If you must expose the REST API and XML-RPC, understand what is enabled — many sites can disable XML-RPC entirely.

// mu-plugin sketch: disable XML-RPC if you do not need it
add_filter('xmlrpc_enabled', '__return_false');

3. Plugin and theme hygiene

Every plugin is code you did not write running with high privileges. Be ruthless.

• Delete what you do not use (deactivated is not the same as gone).
• Prefer well-maintained plugins with a clear update history and support channel.
• Avoid nulled / pirated premium plugins — they are a common malware delivery method.
• Watch for plugins that load heavy scripts on every page when you only need them on one form.

If two plugins do the same job, keep one. Security is not “install five security plugins”; it is “reduce attack surface and monitor one good stack”.

4. HTTPS, headers and host-level basics

Force HTTPS site-wide. Mixed content (HTTP images on HTTPS pages) confuses users and some browsers. On the host:

• Valid SSL certificate with auto-renewal
• Automatic malware scanning if offered
• Web application firewall (WAF) or host firewall rules
• Isolate sites (separate users/accounts) if you run multiple clients

Optional but useful response headers on Apache/Nginx or via a security plugin:

# Conceptual headers (syntax varies by server)
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
Referrer-Policy: strict-origin-when-cross-origin
Permissions-Policy: geolocation=(), microphone=()

Content-Security-Policy is powerful and easy to break on plugin-heavy sites — introduce it carefully on staging.

5. File permissions, wp-config.php and secrets

Your database password and salts live in wp-config.php. That file must not be world-writable or publicly downloadable.

• Typical dirs 755, files 644 (host guidance may differ; never 777).
• Keep backups of wp-config.php offline; never commit it to a public git repo.
• Move salts if you ever suspect a leak (WordPress will log everyone out — that is fine).
• Disallow file editing from the dashboard in production:

// wp-config.php
define('DISALLOW_FILE_EDIT', true);
define('FORCE_SSL_ADMIN', true);

6. Backups you can restore

A backup that has never been restored is a rumour. Aim for:

1. Daily automated backups (files + database)
2. Off-site copy (not only on the same VPS)
3. Retention of at least 14–30 days
4. A restore test every quarter on staging

Before major plugin or PHP upgrades, take a manual snapshot. If ransomware or malware hits, your backup is the business continuity plan.

7. Users, roles and the human layer

Former freelancers with administrator access are a classic footgun. When someone leaves:

• Remove or demote their WordPress user the same day
• Rotate shared passwords (hosting panel, DNS, email, analytics)
• Review application passwords and REST tokens

Editors do not need Administrator. Shop managers do not need to install plugins. Least privilege is free and effective.

8. Monitoring and “something feels wrong”

Watch for sudden admin users, unknown plugins, odd cron tasks, spam injection in posts, or Google Safe Browsing warnings. Uptime monitors (even simple ones) tell you the site is down before a customer does.

Search Console and analytics drops can also signal malware redirects. If traffic tanks overnight, check for injected scripts in headers, widgets and footer.php overrides.

9. If you think you are compromised

1. Take a backup of the infected state for forensics (do not overwrite your clean backups).
2. Put the site in maintenance mode or offline if payments are at risk.
3. Reset all passwords (WordPress, hosting, FTP/SFTP, database, email).
4. Scan with host tools + a reputable security plugin; remove malware carefully or restore from a clean backup.
5. Update everything; rotate salts; re-check users and scheduled tasks.
6. If card data may have been exposed, follow your legal/PCI obligations and payment provider guidance.

For many small businesses, a clean restore from last week’s backup plus hardening is faster than “cleaning” a deeply infected tree file by file.

10. A realistic monthly 20-minute routine

• Apply updates on staging or a quiet window; smoke-test forms and checkout
• Confirm last backup timestamp is recent
• Glance at users list and plugin list for strangers
• Check uptime and Search Console for new issues
• Skim host security email alerts

FAQ

Is WordPress secure enough for a business?
Yes — when maintained. Neglect is the risk, not the logo on the CMS.

Do I need a security plugin?
A good one (or solid host WAF + malware scan) helps. Five overlapping security plugins often hurt performance and clarity.

Is changing the login URL required?
Optional. Prioritise 2FA, strong passwords and rate limiting first.

How often should I backup?
Daily for active business sites; more often if you take constant orders or bookings.

Security is not a product you buy once. It is a short list of habits you keep.

Need a WordPress site that is fast and looked after?

I’m Jamie Freeman — UK web designer and developer. I build and maintain WordPress sites with sensible hardening, backups and performance so you can focus on the business.

Get a free quote →