WordPress is the world’s most popular content management system, and that popularity makes it the top target for attack bots. The good news is that most attacks are automated and look for undefended sites; with a few regular habits, your site drops off that list.
1. Regular Updates
Keep the WordPress core, theme and plugins up to date. A large share of breaches come through known vulnerabilities in plugins that have not been updated for months. Back up the site before major updates.
2. Fewer Plugins, More Security
Every plugin is a potential way in. Don’t just deactivate plugins you don’t use; delete them. Install plugins only from trusted sources and stay away from “nulled” and cracked versions; these often contain malware themselves.
3. Secure Dashboard Login
- Don’t use the admin username, and create a separate account for each person with the least privilege they need.
- Choose a long, unique password and enable multi-factor authentication for administrators.
- Limit failed login attempts so that password-guessing attacks fail.
4. Backups, and Restore Testing
Back up the site’s files and database regularly and keep at least one copy outside the same hosting account. cPanel includes a backup tool, and many hosts also offer automatic backups. Every few months, test a restore on a test subdomain.
5. SSL and HTTPS Always On
Check your SSL certificate in the SSL/TLS section of cPanel and make sure it renews before it expires. The site address in WordPress settings should start with https, and all http addresses should redirect to https. Google also favors secure sites.
6. An Up-to-Date PHP Version
Old PHP versions do not receive security updates and are slower. In cPanel, choose a supported version in the PHP version selector (usually MultiPHP Manager or Select PHP Version); before switching, check theme and plugin compatibility in a test environment.
7. Site Speed
- Compress images before uploading and use lightweight formats such as WebP.
- One lightweight, reputable caching plugin is enough; running several caching plugins at once causes problems.
- Keep heavy page builder plugins only if you really need them.
8. Uptime Monitoring
Set up a simple monitoring service that checks the site every few minutes and sends an email or message if it goes down. You should find out about an outage before your customers do.
Take signs of a hack seriously: an unknown admin user, a sudden change to the homepage, visitors being redirected to another site, or a Google security warning. If you see these, act quickly, change your passwords and restore from a clean backup.
Monthly Checklist
- Update WordPress, the theme and plugins (after a backup)
- Remove unused plugins and user accounts
- Check backups and keep one copy outside the hosting account
- Check that the SSL certificate is valid
- Check the PHP version
- Review site speed and the uptime monitoring report
ITPlus724 cPanel hosting comes with technical support; if you don’t have time for these tasks, ITPlus724 engineers can take over hosting and maintenance of your company’s website.