WordPress Security Standards For Business Websites

The short answer: a secure WordPress website needs six layers. Hide the admin area. Protect every login with passkeys or an app-based code. Update quickly, but carefully. Lock down files and the API. Put a firewall in front of the site. And keep tested backups you can restore in minutes. A single security plugin is not enough on its own.

Why WordPress Sites Get Attacked

WordPress runs a large share of the world’s websites. That makes it the first target for automated attacks.

Most attacks are not aimed at you personally. Bots scan thousands of sites a minute, looking for an old plugin, a weak password or an open door. Many of these bots now use AI to guess passwords, solve simple tests and try known weaknesses at speed.

Most WordPress weak spots are not in WordPress itself. They are in plugins and themes, which is why updates and plugin choices matter so much.

The good news: the basics stop most of these attacks. The standards below follow WordPress’s own hardening guide and the OWASP Top 10, the most widely used list of web security risks.

1. Hide The Admin Area

The safest door is one attackers cannot find.

• Restrict the login pages. Use your firewall, for example Cloudflare, to block /wp-admin and wp-login.php for anyone outside your team’s locations, or put them behind a login portal such as Cloudflare Access.
• Limit login attempts. Slow down or block repeated failed logins.
• Go headless if security matters most. WordPress can run on a private server while visitors see a separate, static website. Then the login page simply does not exist on the public site.

2. Protect Every Login

Passwords are leaked faster than people change them.

• Use passkeys where you can. Passkeys unlock with your phone or laptop’s fingerprint or face scan. There is no password to steal or phish.
• Otherwise, use an authenticator app. App codes are safer than SMS codes, which can be stolen through SIM swaps.
• Give each person their own account. Never share one admin login.
• Use the lowest role that does the job. A writer needs the Author role, not Administrator.
• Remove old accounts. When someone leaves, delete or downgrade their account the same day.

3. Update Quickly, But Carefully

Old software is the most common way in. But updating blindly has its own risk.

• Security fixes: apply them the same day.
• Other updates: wait 24 to 48 hours. Let other sites find any problems first.
• Test big updates on a copy of your site before they go live.
• Delete plugins and themes you do not use. Switched-off plugins can still be attacked.
• Watch for plugins that change owners. A plugin sold to a new company deserves a closer look before the next update.

4. Lock Down Files And The API

Assume something will get in, and limit what it can do.

Turn off the built-in file editor, so nobody can change code from the dashboard. Add this line to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

• Set strict file permissions so the web server cannot rewrite your core files.
• Use read-only file systems if your host offers them.
• Turn off XML-RPC if you do not use it. It is an old door that attackers still knock on.
• Close the public user list. By default, /wp-json/wp/v2/users shows the usernames of people who publish on your site. Restrict it so bots cannot build a list of logins to attack.

5. Put A Firewall In Front

A web application firewall checks traffic before it reaches your site.

• Block known attacks and bad bots at the edge, before they reach WordPress.
• Use HTTPS everywhere, with HSTS so browsers never fall back to an unsafe connection.
• Add security headers that stop other sites framing yours and limit where scripts can load from.

A firewall also helps speed, which helps your Google rankings. See how speed fits into technical SEO.

6. Keep Backups You Have Actually Tested

A backup you have never restored is only a hope.

Follow the 3-2-1 rule:

• 3 copies of your site and database
• 2 different places, for example your host and separate cloud storage
• 1 copy off-site, away from your hosting company

Then test it. Restore a backup to a test copy of your site at least twice a year and check that it works.

The Standard At A Glance

Standard	What to do	How often
Hidden admin	Restrict /wp-admin and wp-login.php at the firewall	Once, then review yearly
Strong logins	Passkeys or app codes for every account	Check when staff change
Safe updates	Security fixes same day, others after 24 to 48 hours	Weekly
Locked files	File editing off, strict permissions, user list closed	Once, then after big changes
Firewall	Edge firewall, HTTPS and security headers	Always on
Backups	3-2-1 copies, plus a backup after every update	Daily, and test twice a year
Security check	Review against the OWASP Top 10	Twice a year

What We Do For Our Maintenance Clients

Every WordPress site on our website maintenance plan gets:

• WordPress core, theme and plugin updates
• Security patches for the website
• A backup after every update, sent to you securely
• An OWASP Top 10 security check by hand, twice a year
• Up to 1 hour of small changes every month
• A reply within 4 business hours

When malware hit our own site, we caught it within 24 hours. You can read how on our website maintenance page.

Building something new? Our WordPress websites are set up with these standards from day one.