You launched your WordPress website, it looks great, and leads are coming in. Then one morning you open it and see a strange redirect, a “Not Secure” warning, or a blank page. Or worse, Google flags your site as dangerous.
Why WordPress Sites Get Attacked
WordPress powers a huge share of the internet, so attackers focus on it. Most attacks are automated. Bots scan thousands of websites at once, looking for old plugins, weak passwords and the default login page. Your business does not need to be famous to be a target. It only needs to be easy.
Here is the part most people do not know. WordPress itself is rarely the problem. The core software is well maintained and gets security fixes quickly. Attacks usually come through three doors: outdated plugins and themes, weak or reused passwords, and poor hosting. Close those three doors and you have removed most of the risk.
The WordPress Security Checklist
1. Choose good hosting, not just cheap hosting
Hosting is the foundation of your website’s security. Slow, overcrowded or poorly managed servers are easier to break into and harder to recover from.
A good host gives you:
- A strong server-level firewall
- Automatic malware scanning
- Regular backups
- Up-to-date server software
- Fast support when something goes wrong
At Sarvantic, we host client websites on trusted providers such as
Whatever you choose, pick a provider with a good reputation, not the lowest price on the page.
2. Only install plugins and themes you trust
Every plugin is extra code running on your website. If that code is poorly written or abandoned, it becomes a way in.
Before you install anything, ask:
- Is it from the official WordPress directory or a known, reputable developer?
- Is it updated regularly, and does it support your current WordPress version?
- Does it have a good number of active installs and honest reviews?
- Do you actually need it?
Never use “nulled” or pirated premium plugins and themes. They are free for a reason: they very often contain hidden backdoors. Delete plugins you are not using, and do not leave inactive ones sitting on the site.
3. Keep everything updated
This is the single most important habit. Updates fix security holes that are already publicly known, and attackers move fast to exploit sites that have not updated.
Keep these current:
- WordPress core
- Your plugins
- Your theme
- Your PHP version, which is set on your hosting account
Old PHP versions stop receiving security fixes. Running one is like leaving a door unlocked because the lock is no longer made. Updates should also be tested first, because a rushed update can break your layout or checkout. This is why many businesses leave it to a professional.
4. Protect your login page
Everyone knows the default WordPress login address is /wp-admin or /wp-login.php, and so do the bots. Changing the login URL to something custom cuts a large amount of automated attack traffic.
To be clear, a hidden login URL is not a replacement for strong passwords and two-factor login. It is one extra layer. Also limit login attempts, so that someone guessing passwords is blocked after a few tries.
5. Use strong, unique passwords and two-factor login
Weak and reused passwords are one of the easiest ways for someone to take over a website. Attackers use leaked passwords from other breaches and try them on your login page automatically.
- Use a long, unique password for every account, and keep them in a password manager
- Never use “admin” as a username
- Turn on two-factor authentication for every administrator
- Give team members only the access level they need, and remove accounts of people who have left
6. Use a strong firewall
A firewall sits in front of your website and filters out harmful traffic before it reaches WordPress.
- Hosting firewall: a good host includes one. This is another reason hosting matters.
- Cloudflare Free plan: a great starting point for most small and medium sites. It adds a layer of protection against bots, common attacks and traffic floods, and it can also help speed.
- Cloudflare Pro or higher: if you run a larger website, an online store, or a high-traffic business site, the paid plans give you more advanced protection and rules, which is worth considering.
You can also add a security plugin with a web application firewall and malware scanner, but pick one well-known plugin. Installing several security plugins together can cause conflicts.
7. Keep regular backups, and test them
No security setup is perfect, so you need a way back. A backup is your insurance policy.
- Take automatic daily or weekly backups, depending on how often your content changes
- Store them away from your website server
- Occasionally test that a backup can actually be restored
A backup that has never been tested is only a hope.
8. Use SSL and secure your website settings
Your site should always load over HTTPS. Beyond that, a few quick configuration checks make a difference: disable the built-in file editor in the dashboard, set correct file permissions, and turn off anything you are not using, such as XML-RPC.
9. Building With AI-Generated Code (“Vibe Coding”)? Double-Check Everything
AI tools now let almost anyone generate WordPress plugins, snippets and whole features in minutes. This is useful, but it brings a new common mistake: code that works is not the same as code that is safe.
AI-generated code can look perfect and run without errors while still skipping the basics: no input sanitizing, no nonce or permission checks, unsafe database queries, or secret keys written directly into the code. Anyone can paste it into a website, but not everyone can spot what is missing.
If code, from AI or anyone else, is going onto your website, follow these rules:
- Never paste it straight onto the live site. Try it on a staging copy first.
- Review it for security, not only for whether it works. Check how it handles user input, database queries and logins.
- Test it properly. Try it with wrong, empty and unexpected input, and check it with a security scanner.
- Have an experienced developer approve it before launch, especially for forms, payments, user accounts and anything that touches your database.
- Keep a backup so you can roll back immediately if something goes wrong.
AI is a fast assistant, not a security auditor. Speed is only an advantage when the code is checked before it reaches your customers.
10. Custom Code Needs Extra Care: SQL Injection and Other Developer-Level Risks
Everything above protects the website you have. But there is another risk that comes from how a website is built, and it depends completely on the developer: insecure custom code.
The best-known example is SQL injection. If a custom plugin, form or search feature passes what a visitor types straight into the database, an attacker can type database commands instead of normal text. The result can be stolen customer data, new hidden admin accounts, deleted content, or malicious code and spam links added to your pages. Related problems include cross-site scripting (XSS), where harmful scripts are injected into your pages, and missing permission checks that let the wrong people use admin features.
Many hosting providers and firewalls, and WordPress itself, block a lot of these attacks. But they cannot fix a hole inside code that was written badly. If you have a custom plugin, a custom theme or a custom-built feature, its security is only as good as the person who wrote it.
A careful developer will always:
- Use prepared statements for every database query, so user input is never treated as a command
- Sanitize everything coming in and escape everything going out
- Use nonces and capability checks, so only the right people can perform sensitive actions
- Avoid building custom code when a trusted, well-maintained plugin already does the job
- Review and test the code for security before it goes live
When you hire an agency for custom work, ask them how they handle security and testing. A good answer is specific. A vague answer is a warning sign.
If You Get Hacked, Deleting the Plugin Is Not Enough
This is a very common mistake. A website gets infected, someone finds the bad plugin, deletes it, and assumes the problem is over. Often it is not.
Skilled attackers leave backdoors behind so they can get back in later. These can be hidden in:
- Theme and plugin files
- The uploads folder
- Fake admin users
- The database
- Scheduled tasks inside WordPress
A real cleanup means checking all of these, not only removing the plugin that was the entry point. After the cleanup you should also:
- Change every password: WordPress users, hosting, database, FTP and email
- Reset the WordPress security keys
- Update everything to the latest versions
- Check Google Search Console for security warnings
- Find out how the attacker got in, so it does not happen again
If you are not sure your site is truly clean, it probably needs a professional check.
The Common Mistake: “Set It and Forget It”
Most people treat a website like a poster. Build it once, hang it up, done. In reality a website is closer to a shop or a car. It needs regular care.
The moment you stop updating, new vulnerabilities pile up. Months later, a small problem becomes a hacked site, lost rankings, lost customers and an expensive emergency fix. Prevention costs far less than recovery.
How a Website Maintenance Plan Helps
Most business owners are too busy to log in every week and check updates, backups and security logs. That is exactly why website maintenance plans exist.
At Sarvantic, our maintenance plans take this work off your hands. Depending on your needs, a plan can include:
- Regular updates of WordPress, plugins, themes and PHP, tested before going live
- Automated backups with restore support
- Malware scanning and security monitoring
- Firewall and Cloudflare setup
- Uptime and performance checks
- Quick support when something looks wrong
You get peace of mind, and your website stays fast, safe and ready to bring in business.
Want us to check your website's security or take care of it every month?
Contact Sarvantic and ask about our website maintenance and support plans. We will review your site and tell you honestly what it needs.
Final Thoughts
Website security does not have to be complicated. Most hacked sites were not attacked by genius criminals. They were simply left behind: old plugins, weak passwords, and nobody looking after them.
Follow this checklist, or let a team look after it for you, and you will avoid most of the problems businesses face.
