Search “WordPress security” and you’ll find 40-point checklists that read like preparing a site for war: rename your login URL, hide your WordPress version, block entire countries, install three security plugins.
Here’s the honest version: small-business WordPress sites are almost never “hacked” the way owners imagine, a person, targeting you, defeating your defenses. They’re compromised by automated scripts scanning millions of sites for a handful of known, boring weaknesses. The bots don’t care who you are. They care whether you left one of five doors open.
Close those five doors and you’ve prevented the overwhelming majority of real-world compromises. Everything else is diminishing returns.
Every hacked site we’ve rescued in the past two years traces back to the same two causes: an outdated plugin or a compromised account.
The five doors, in priority order
1. Outdated software: the front door
The number one cause of WordPress compromises, and it isn’t close: a plugin or theme with a publicly known vulnerability, left unpatched. When a security hole is found in a popular plugin, it gets a public disclosure, and within hours, bots are scanning the internet for every site still running the vulnerable version. Your risk window is the gap between the patch existing and you applying it.
What this means practically: updates are not a chore to batch up quarterly. They are the security measure. Everything else on this list is secondary to simply staying current, which, as we’ve written before, is best done tested on staging rather than blindly.
2. Weak or reused passwords, the key under the mat
The second-biggest cause is embarrassingly simple: an admin account with a password that’s guessable, or one that leaked from some other service in some other breach and gets tried here by bots (“credential stuffing”). The fix costs nothing:
- A long, unique password per admin account, kept in a password manager
- Two-factor authentication (2FA) on every administrator login – this single free measure defeats the entire password-guessing category
- Delete stale admin accounts. Every account is a door; a departed contractor’s forgotten admin login is a door nobody’s watching. We routinely find 5+ admin accounts on sites run by two people.
3. No firewall, nothing filtering the door traffic
A web application firewall (WAF) filters malicious requests before they reach WordPress: exploit attempts, brute-force login floods, known bad actors. This is one plugin (or a host/DNS-level service) and it’s the measure that buys you time when door #1 is briefly open, many firewalls block exploitation attempts for freshly disclosed vulnerabilities before you’ve had a chance to update.
4. No malware scanning, a break-in nobody notices
Compromises aren’t loud. The profitable ones are silent: SEO spam injected into your pages, redirect code that only triggers for Google visitors, a phishing kit parked in a subdirectory. Sites run compromised for months while looking normal to the owner. Regular malware scanning, and someone who actually reads the scan results turns “months” into “days.” The damage difference is enormous: early detection is a cleanup; late detection is a cleanup plus blacklisted domain, poisoned search results, and burned customer trust.
5. SSL and forced HTTPS, the minimum the world now expects
By 2026 this is nearly universal, but “we have a certificate” is not the same as “everything is forced through HTTPS.” Mixed-content sites and non-redirected HTTP variants still turn up in audits, and they cost trust (browser warnings) and SEO. Certificates are free (Let’s Encrypt); there is no excuse tier anymore.
The noise: popular advice that barely matters
In fairness-to-your-time order, things checklists love that bots don’t care about:
- Hiding your WordPress version. Bots don’t check your version and politely leave, they fire exploits at everything. Patched is protected; hidden is not.
- Renaming the login URL. Mild spam reduction, zero protection against the actual causes above. 2FA does this job properly.
- Country blocking. Attacks come through proxies and hijacked servers everywhere, including your own country.
- Multiple security plugins. Two firewalls don’t make you twice as safe; they conflict, slow the site, and double the false alarms. One good one, configured, beats three installed.
None of these are harmful (except the plugin stacking). They’re just where paranoia goes to feel productive while door #1 stands open.
The honest small-business security checklist
The complete version, printable:
- ☐ Everything updated promptly (core, theme, plugins, PHP) — tested on staging
- ☐ Unique passwords + 2FA on all admin accounts; stale accounts deleted
- ☐ One firewall, configured
- ☐ Malware scanning that a human reviews
- ☐ SSL with forced HTTPS everywhere
- ☐ And — tested, off-site backups, because security is what you do before an incident; backups are why an incident isn’t fatal
If maintaining that list sounds exactly like the ongoing work you didn’t want to own: that’s what a care plan is, doors 1 through 5, handled continuously, reported monthly. Across the sites under our care, we’ve had zero successful compromises in over 5 years.
Find out which doors are open on your site
Our free WordPress Health Check covers security as one of seven scored areas, including exactly the five doors above, checked with evidence. You get the report either way; what you do with it is up to you.