Maintenance, security, repairs, hosting and operational guidance for WordPress and WooCommerce.
View topic guides01 / GUIDE
Security maintenance is a process, not a plugin
No security plugin can compensate for abandoned software, weak administrator access, poor backups, unmanaged hosting or unknown people retaining privileged accounts. WordPress security is strongest when application maintenance, infrastructure, access control and recovery planning work together.
The objective is not to claim “100% secure”. The objective is to reduce the attack surface, detect important problems earlier and make recovery less chaotic if something still goes wrong.
02 / GUIDE
1. Keep WordPress, plugins and themes supportable
Unsupported or neglected software increases risk because known vulnerabilities may remain exposed. Remove plugins and themes that are no longer required, keep supported components current, and treat major updates as controlled changes rather than blind clicks.
For business-critical sites, take a recoverable backup before higher-risk changes and verify the key customer journeys afterwards.
03 / GUIDE
2. Reduce administrator risk
Review administrator accounts regularly. Remove old agency, contractor and employee access when it is no longer required. Give people the lowest level of access that lets them do their job. Use strong unique credentials and multi-factor authentication where the identity or security stack supports it.
Shared administrator accounts make accountability and offboarding harder. Named accounts are easier to audit.
04 / GUIDE
3. Treat backups as a security control
Backups protect against more than server failure. They can be essential after malicious file changes, destructive admin actions, failed updates or database corruption. Keep sufficient history to avoid discovering that every available backup already contains the problem.
At least one copy should be logically separate from the live website. Restore procedures should be documented and periodically tested.
05 / GUIDE
4. Harden the environment without breaking maintainability
Security headers, file permissions, PHP configuration, database access, TLS, firewall rules, login controls and server patching can all contribute to defence in depth. But hardening should be understood and documented. Copying random snippets into configuration files can create fragile systems that fail during updates or migrations.
WordPress publishes a detailed hardening guide that is a better starting point than generic “secure WordPress in five minutes” advice.
06 / GUIDE
5. Monitor the signals that matter
Useful monitoring can include uptime, unexpected file changes, administrator creation, malware or vulnerability alerts, certificate problems, backup failures and unusual resource use. Alerts need an owner and an escalation route. An inbox receiving warnings nobody reads is not a control.
07 / GUIDE
6. Know what you would do after a suspected compromise
Before an incident, know who controls the domain, hosting, WordPress admin, DNS, email and backups. Preserve logs and evidence where possible. Avoid immediately deleting everything or installing multiple “cleaner” plugins because that can destroy evidence and complicate recovery.
A professional response may include containment, credential rotation, file and database review, vulnerability removal, clean restoration and post-incident hardening. The exact sequence depends on what happened.
08 / GUIDE
A monthly WordPress security maintenance checklist
- Review pending core, plugin and theme updates.
- Remove unused or abandoned components.
- Confirm backups completed and remain restorable.
- Review administrator and privileged accounts.
- Check security and vulnerability alerts.
- Verify SSL/TLS and key public pages.
- Check forms, login, checkout or other critical journeys.
- Investigate unexpected redirects, new users, changed files or unusual server load.
- Record any significant changes.
Higher-risk sites may need some of these checks daily or continuously rather than monthly.