What does securing a WordPress site involve?
Securing a WordPress site means running six controls together: hardening the configuration, controlling who can change the site, monitoring for unauthorized change, applying updates after testing them, keeping backups that have been restored at least once, and having a response plan. No combination makes a site incident-proof; the goal is lower odds and a shorter time between a problem and someone noticing it.
If the site has already been compromised, start with fixing a hacked WordPress site.
How do the six controls fit together?
They fall into three groups. Hardening, access control, and tested updates reduce the chance of a problem. Monitoring tells you when one happens anyway. Backups and a response plan let you recover.
Each group fails without the others. A hardened site with no monitoring can be changed quietly for weeks. Monitoring with no restorable backup shows the damage and cannot undo it.
Where should you start if none of this is in place?
Start with the two things that limit damage whatever else goes wrong: who has access, and whether a backup can be restored.
- Inventory access. List every account that can change the site, the host, the domain, and DNS. Remove what is not needed and require two-factor authentication on the rest.
- Test a restore. Restore a backup to a separate environment. A backup nobody has restored may not restore when it matters.
- Set up tested updates. Create a test copy of the site, decide the release schedule, and decide who can change the live site.
- Add monitoring. File change alerts that reach a person who can act on them.
- Harden the configuration. Headers, permissions, and access rules, rolled out on the test copy first.
- Write the response plan. A decision owner, a contact list, and where the access list, backups, and logs are kept.
None of it needs to wait for the whole program to be designed.
Who should be able to change the site?
As few accounts as the work needs, each with the least access it needs, and every one behind two-factor authentication. Accounts for former staff, contractors, and vendors stay active until someone removes them, so review access on a schedule. Hardening covers least privilege, two-factor authentication, and login protection.
What makes a backup worth having?
A tested restore. Keep backups off the server, and restore one to a separate environment before you need it, so you know it works. A recent backup also turns a bad release into a short rollback; see managing WordPress updates safely.
What does hardening a WordPress site do?
Hardening narrows what an attacker can reach and limits what a stolen login can do: security headers, TLS, file permissions and ownership, database privileges, and least-privilege access with two-factor authentication. Most of it is configuration. The part that takes judgment is doing it without breaking analytics, forms, or other services the site depends on.
How do you know when a file changes?
File integrity monitoring compares the site’s files against a known-good baseline on a schedule and flags what was added, modified, or deleted. An alert is only useful if someone owns the triage, so the hard part is routing and upkeep, not the scan.
How do you patch quickly without breaking the site?
Apply updates to a test copy first, verify the site works, and release to the live site on a schedule. A security release that cannot wait gets an expedited version of the same path. A site that blocks plugin and core changes from the admin with DISALLOW_FILE_MODS also loses WordPress’s automatic updates, so that expedited path has to exist before it is needed.
Serious flaws in WordPress core are rare, as our post on the WordPress 7.0.2 security release notes, and that release fixed one.
What changes when the site is regulated?
The controls are the same. What changes is that you may have to prove them to a regulator or an auditor, which depends on four properties: controlled access, a controlled change process, an audit trail, and protections that keep working as the site grows. See WordPress security for financial services and healthcare sites.
What should you plan before something gets through?
An incident response plan names who decides, who gets called, and what is already in place when the incident starts: tested backups, access logs, and file change monitoring. It also decides when to preserve a copy of the site and its logs before cleanup, since cleanup destroys the original state. Once something is found, follow fixing a hacked WordPress site.
Who owns the site’s security?
One named person or team, with the authority to act on access reviews, updates, monitoring alerts, and the response plan.
A security plugin does not fill that role. It can scan, block, and alert, but it does not decide who may edit the live site, read the alerts, or take the site offline. And because it runs inside the site, a compromise can disable it.
How much of this applies to a smaller site?
Less, but not none. Our post on who owns your website’s security makes the point that “a site that collects no personal data can still be used to steal your customers’ passwords,” because visitors trust the links on it. So even a brochure site needs access control, a restorable backup, and prompt updates.
Monitoring, a formal release schedule, and a written plan scale with what an incident would cost. Ask what an hour of the site being defaced, offline, or sending visitors to a fake login page would cost, and run the program in proportion.
What should a security program report back to you?
What was done and what was found, on a regular schedule, in plain language: which updates were applied and when, which alerts fired and how they were resolved, when a restore was last tested, and who currently has access to the site. A program that reports nothing leaves you unable to tell whether it is working.
How does 84EM run a security program?
We harden the site and limit who can change it, apply updates on a test copy before they reach the live site, keep restore-tested backups and login and change logs, and monitor for unauthorized changes. When something gets through, we contain it first, preserve the evidence, then clean and restore the site and change what let it happen, keeping you informed throughout.
