Guide · Security
CMS security basics: keeping WordPress and other CMS sites safe
Content management systems power a large share of business websites. Their popularity is also their risk: vulnerabilities in a popular CMS or plugin are exploited automatically across thousands of sites within days of publication. Most compromised CMS sites were not targeted individually — they were simply not updated. The basics below prevent the majority of incidents.
[ 01 ]
In short
In short
- 01
Keep the core, plugins and themes updated, testing updates on a staging copy first.
- 02
Minimise plugins: each one is code you trust; remove unused ones completely.
- 03
Protect the admin area: unique accounts, strong passwords, two-factor authentication, limited login attempts.
- 04
Keep tested backups off the server.
- 05
Choose hosting that isolates sites and supports current software versions.
- 06
Monitor for changes and have an incident plan.
[ 02 ]
Guide
Updates
- Apply security updates promptly; subscribe to security announcements for your CMS and key plugins.
- Test updates on staging to avoid breaking the site. See staging and testing.
- Keep the server software (PHP or other runtime, database) on supported versions.
Plugins and themes
- Install only from official, reputable sources.
- Prefer actively maintained plugins with recent updates and many users.
- Avoid "nulled" (pirated) premium plugins — they often contain backdoors.
- Remove, not just deactivate, what you do not use.
- Fewer plugins mean fewer vulnerabilities and faster sites.
Admin access
- Individual accounts for each editor with the lowest role that allows their work.
- Strong unique passwords and two-factor authentication.
- Limits on login attempts and, where possible, restricting admin access by IP or through a VPN.
- No "admin" usernames or shared accounts.
See access management for teams.
Hosting and server
- Isolation between sites on the same server, so one compromised site does not infect others.
- HTTPS everywhere.
- Correct file permissions; disable file editing from the admin panel.
- A web application firewall in front of the site. See DDoS protection.
Backups
Automatic backups of files and database, stored off the server, with periodic restore tests. See backup strategy.
Monitoring
- Uptime and certificate monitoring.
- File integrity monitoring or security plugins that alert on changes.
- Alerts for new admin users.
- Search Console security reports.
Forms and inputs
Contact forms, comments and uploads are common attack surfaces. Use spam protection, restrict upload types and sizes, and keep form plugins updated.
When a CMS is not the right choice
For sites with complex business logic, strict security requirements or heavy customisation, a custom application or a headless setup may be easier to secure than a CMS with many plugins. See WordPress vs custom development.
[ 03 ]
FAQ
Frequently asked questions
Is WordPress insecure?
The core is actively maintained and reasonably secure when updated. Most incidents come from outdated plugins, themes and weak passwords.
Should we enable automatic updates?
Automatic security updates for the core are generally recommended. For plugins, automatic updates reduce risk but can break functionality; balance with staging tests and monitoring.
How do we know if our site is already compromised?
Signs include unknown admin users, unexpected redirects, spam pages in search results and security warnings. A security scan and audit can confirm. See website hacked: what to do.