How to Secure a WordPress Website (UK Small Business Guide, 2026)
Need a website? Price it in a minute
Some links here are affiliate links: we may earn a small fee if you buy, at no extra cost to you.
Pick a package, tick what you need and see the project price and monthly cost straight away. Pay securely online.
Price Your Website →Most hacked WordPress sites were not targeted personally. Automated bots scan the internet for old plugins, weak passwords and unpatched themes, and break into whatever they find. That is good news, because the same handful of habits stops most of it.
Want a firewall and malware scanning for your site?
Sucuri adds a website firewall, daily malware scanning and clean-up help if your site is ever hacked. It works with WordPress and other platforms, and it sits in front of your site so attacks are blocked before they reach it.
See Sucuri website security →Affiliate link: we may earn a small fee at no extra cost to you.
1. Keep WordPress, themes and plugins updated
Out-of-date plugins are the most common way in. Turn on automatic updates for security releases, and delete any plugin or theme you are not using. Deactivated is not the same as safe; remove it.
2. Use strong logins and two-step verification
Never use ‘admin’ as a username, use a long unique password, and add two-step verification for every account that can edit the site. Limit login attempts so bots cannot guess endlessly.
3. Back up off the server
A backup stored only on the same hosting account can be lost in the same attack. Keep a recent copy somewhere else and test that you can restore it.
4. Add a website firewall and malware scanning
A firewall sits in front of your site and blocks malicious traffic before it reaches WordPress. A service such as Sucuri combines a website firewall, malware scanning and clean-up help if the worst happens. It is most worth considering if your site takes bookings, payments or enquiries, because downtime costs you money.
5. Choose decent hosting
Good hosting isolates accounts from each other, runs current PHP and takes server-level backups. Cheap shared hosting that is never updated undoes a lot of careful work. See our hosting experience for what we look for.
6. Watch for the warning signs
- Google showing a ‘this site may be hacked’ warning
- Strange pages or adverts you did not add
- Your site redirecting visitors elsewhere
- Hosting provider suspending the account
- Admin users you do not recognise
7. If your site is hacked
- Do not panic and do not just delete files; you may miss the hidden backdoor
- Change passwords for WordPress, hosting, FTP and email
- Restore a clean backup or use a malware clean-up service
- Update everything, then check Google Search Console for security issues
- Find how they got in, otherwise it happens again
For the wider picture beyond your website, see our cyber security checklist for small businesses.
Quick checklist
- Updates on, unused plugins removed
- Strong logins with two-step verification
- Off-site backup, tested
- Firewall and malware scanning in place
- Search Console set up to flag problems
Want this sorted for you? Get in touch and we will tell you plainly what your site needs.
Want a firewall and malware scanning for your site?
Sucuri adds a website firewall, daily malware scanning and clean-up help if your site is ever hacked. It works with WordPress and other platforms, and it sits in front of your site so attacks are blocked before they reach it.
See Sucuri website security →Affiliate link: we may earn a small fee at no extra cost to you.
Ready to price your website?
See the one-off price and the monthly cost for what you need, then pay securely online. No sign-up, no waiting for a quote.
Price Your Website →