WordPress Security Checklist for Small Business Websites
Your website is usually the first thing a customer sees, and the last thing anyone thinks about until it stops working. WordPress runs a large share of small business sites, which is why it attracts so much automated attention. The compromises we hear about from businesses around Edinburgh and the Lothians are rarely clever — they're opportunistic, and preventable with a short list of habits.
Keep the core, themes and plugins updated
The common route in is a known flaw in an out-of-date plugin or theme rather than the core software itself. Automated scanners crawl the web for versions with published vulnerabilities, so an unpatched site is found quickly. Turn on automatic updates for core security releases, and put a recurring slot in the diary to review everything else.
- Update on a schedule, not a whim. Weekly or fortnightly is fine; six months is not.
- Test somewhere first if the site earns money. A staging copy costs far less than a broken checkout.
- Retire abandoned components. If a plugin hasn't been updated in years, it will never be patched.
Harden the admin accounts and the login page
Administrator accounts are the prize. Avoid the default username, use a long unique passphrase that exists nowhere else, and switch on multi-factor authentication for every account that can change the site. If you only do one thing on this list, do that one — the reasoning is the same as for your email and banking, which we cover in our guide to strong passwords and MFA.
Brute-force attempts against the login page are constant background noise on any public site, so add rate limiting: a short lockout after a handful of failures makes guessing impractical without inconveniencing anyone. Moving the login away from the default address reduces the noise a little, but treat it as tidying rather than security.
Give people the least access they need
WordPress has built-in roles for a reason. Someone who writes news posts needs Author or Editor, not Administrator. Handing out admin rights because it is quicker means every phished password becomes a full site takeover rather than a nuisance.
- Audit the user list quarterly. Old staff, former agencies and long-finished freelancers accumulate quietly.
- Remove, don't demote, accounts nobody uses. A dormant login is an unguarded door.
- Give contractors their own account. Shared logins make it impossible to tell who changed what.
Be ruthless about plugins
Every plugin is code someone else wrote, running with access to your site and its database, so the honest measure is not what it does but who maintains it. Look for recent updates, a named developer or company behind it, and compatibility with current versions. Then keep the list short: deactivating a plugin is not enough, because the files stay on the server and can still be reachable. Delete what you no longer use, including unused themes.
Keep backups somewhere the site cannot reach
A backup stored on the same server as the website is not a backup — anything that encrypts or defaces the site reaches it too. Keep copies off the server entirely, keep more than one generation, and test a restore occasionally so you find out about a broken backup on a calm Tuesday rather than mid-incident. That last point matters most when the problem is ransomware, where your only real leverage is a clean copy you can restore. The 3-2-1 principle applies to websites exactly as it does to your business data.
Get HTTPS and file permissions right
HTTPS should cover the whole site, not just the contact form, with plain HTTP redirected and the certificate renewing automatically before it lapses. On the server side, the principle behind file permissions is simple: the web server should read your site's files, and write only to the specific places that genuinely need it, such as the uploads folder. Anything looser lets one flaw turn into a rewritten site.
Watch it, so you find out first
The worst outcome is learning about a compromise from a customer or from Google's warning page. Uptime monitoring, a file-change or malware scan, alerts when an administrator account is created, and a periodic look at the user list will surface most trouble early. Decide in advance who takes the site offline and who you call, because that call is much harder at eight on a Friday evening.
We can look after the site as well as the IT
We design and host business websites, provide email hosting, and maintain WordPress sites other people built, for businesses in Edinburgh, Livingston and Linlithgow from our base in Wishaw. On a site we host or manage, the updates, backups, permissions and monitoring above are part of your business IT support and cyber security rather than a job nobody owns. Tell us what you run today and you'll get a clear quote before any work.