A WordPress site needs regular care. Most hacked sites are compromised through outdated plugins, weak logins or abandoned add-ons. This checklist covers the routine jobs that keep a small business website safe and fast.
Every week
- Check for updates to WordPress core, your theme and plugins. Apply security updates promptly.
- Confirm your backup ran. A backup you never checked is only a hope.
- Review comments and form spam if you have them.
Every month
- Test a backup restore on a staging site or at least confirm you can download the files.
- Remove unused plugins and themes. Deactivated is not the same as deleted, as old code can still be exploited.
- Review user accounts. Delete people who no longer need access and keep few administrators.
- Check your site on a phone and test key pages and forms.
- Run a speed test such as PageSpeed Insights and fix any new problems.
Secure your logins
- Use long unique passwords and a password manager.
- Turn on two-factor authentication for administrators.
- Limit login attempts and do not use the username “admin”.
- Keep your hosting account, domain registrar and email accounts secure too.
Choose plugins carefully
Install plugins from the official directory or well-known developers. Check when they were last updated and how many sites use them. Avoid “nulled” or pirated premium plugins, which often contain malware.
Use good hosting and HTTPS
Reliable hosting with automatic backups, up-to-date PHP and a free SSL certificate makes a real difference. Make sure the whole site loads over HTTPS.
Monitor your site
- Use an uptime monitor that emails you when the site goes down.
- Connect Google Search Console to see crawl errors and security issues.
- Consider a security plugin that scans for changed files.
If your site is hacked
- Stay calm and do not delete things yet.
- Change all passwords, including hosting and database.
- Restore from a clean backup taken before the problem.
- Update everything and find how they got in.
Frequently asked questions
How often should I update?
Check weekly. Apply security updates as soon as you reasonably can, ideally after a quick test.
Do I need a security plugin?
It can help, but updates, backups and strong logins matter more.
Can you look after my site?
Yes. We offer WordPress care plans covering updates, backups and monitoring.
