WordPress security advice is usually a long list of things you will never do. Here are five habits that genuinely reduce your risk, in rough order of how much they matter.
1. Keep WordPress, plugins, and themes updated
The large majority of hacked WordPress sites were running known-vulnerable software with a fix already available. The attack was not clever. It was automated, and it found a plugin that had not been updated in months. Updating is unglamorous and it is the single most effective thing you can do. If you put off updates because they sometimes break the site, that is a hosting problem, not a reason to skip them. A good host gives you a staging copy to test on first.
2. Use strong, unique logins and limit who has them
Reused passwords are how one leaked database becomes a break-in on your site. Every admin account should have a long, unique password and two-factor authentication. Just as important, most sites have too many admin accounts. The freelancer from two years ago does not need access any more. Review your user list and remove anyone who should not be there.
3. Put a firewall in front of the site
A web application firewall blocks the common attacks, bad bots, brute-force login attempts, and probes for known vulnerabilities, before they reach WordPress at all. A plugin firewall helps, but it still runs inside WordPress, after the request has already arrived. A server-level firewall stops the traffic earlier and does not slow your site down to do it. On every Forge server this is set up for you, along with server-level security that watches for malicious activity.
4. Take real backups, and test them
A backup you have never restored is a hope, not a backup. You want automated daily backups, stored off the server so a compromised site does not take its own backups down with it, and you want to know you can actually restore one. The day you need a backup is the worst possible day to discover it was not running.
5. Use HTTPS everywhere and keep transactional email working
Every site should be served over HTTPS with a valid SSL certificate, no exceptions. It protects logins and form data in transit and it is expected by browsers and customers alike. Less obvious, but related, is email. When your contact forms and WooCommerce receipts silently fail or land in spam, you lose the trail that tells you something is wrong. Reliable transactional email is part of a healthy, observable site.
What this looks like on managed hosting
Notice that three of these five are really hosting decisions. The firewall, the backups, and SSL are things your host should handle so you do not have to think about them. That is the point of managed hosting. You keep the habits that are yours, strong logins and timely updates, and the server takes care of the rest.
If you would rather not run the security stack yourself, see how Forge handles it on every server, or move your site to us for free and land on a server that is set up this way from the start.
