If you run a business on WordPress, you have probably wondered whether your site is safe. The honest answer is that most WordPress sites are not hacked by someone who chose them. They are found by automated tools that scan the internet for the same common mistakes, day and night.
The good news is that you can check for most of those mistakes yourself. You do not need to be technical. You need your WordPress admin login, your hosting account, and about half an hour.
1. Are WordPress, your theme, and your plugins up to date?
Log in to your WordPress dashboard and open Dashboard → Updates. Look for pending updates to WordPress itself, your theme, and your plugins.
Outdated plugins are one of the most common ways into a WordPress site. When a security flaw is fixed in an update, the fix also tells attackers what to look for on sites that have not updated yet.
What to do: apply updates promptly, ideally after taking a backup. If a plugin has not been updated by its developer in a long time, ask whether you still need it.
2. Do you still use every plugin and theme you have installed?
Open Plugins and Appearance → Themes. Deactivated plugins and unused themes are still files on your server, and some can still be exploited.
What to do: delete anything you do not use. Keep one default theme as a fallback and remove the rest.
3. Who can log in?
Open Users and look at every account, especially administrators.
- Remove accounts for people who no longer work with you, such as past employees, agencies, and freelancers.
- Give each person the lowest role that lets them do their job. Most people do not need to be administrators.
- Make sure nobody shares a login.
Do the same in your hosting account and your domain registrar. Access to those is often worth more to an attacker than access to WordPress.
4. Is two-factor authentication turned on?
A stolen or guessed password should not be enough to take over your site. Two-factor authentication asks for a second step, such as a code from an app on your phone.
What to do: turn it on for every administrator account in WordPress (a reputable security or two-factor plugin can add it), and in your hosting and domain accounts.
5. Does your site always use HTTPS?
Type your address into a browser starting with http:// instead of https://. You should land on the https:// version automatically, with no certificate warnings.
What to do: if you stay on http://, or see a warning, ask your host to install a certificate and redirect all traffic to HTTPS. Most hosts do this for free.
6. Can strangers see files they should not?
Websites sometimes leave behind files that were never meant to be public: old backups, export files, or copies of configuration files. These can contain passwords and customer data.
What to do: ask whoever manages your hosting whether backups are stored inside the public website folder, and move them somewhere private if they are. If you use a backup plugin, check where it saves its files.
7. Can someone send email pretending to be you?
This one is not about WordPress itself, but it affects your business directly. Without the right DNS records, anyone can send email that appears to come from your domain, which makes phishing your customers and staff much easier.
The records that prevent this are called SPF, DKIM, and DMARC. Your email provider has instructions for setting them up, and your domain registrar or DNS provider is where they go.
Where to go from here
If any of these checks turned up a surprise, start with updates and logins. They are the most common ways in, and the cheapest to fix.
For a quick automated look at your HTTPS redirect, security headers, SPF, and DMARC, try the free quick check on the website security audit page. If you would rather have someone check everything properly, the website security audit checks outdated software, HTTPS, exposed files, and email records from this list, plus your security headers and TLS setup. You get a plain-language summary, the fixes done for you, and a re-check to confirm they worked.