WordPress Security: Maintenance & Protection Steps

Proper maintenance of a WordPress site is critical for security and smooth operation. With appropriate care and regular checks, you can prevent potential unwanted infections and malicious content, keeping your site always safe and up-to-date.

Below, we outline the basic actions that should be performed regularly to ensure your site remains updated and protected.

Basic Prevention and Maintenance Steps

Updates

• Always perform updates to the WordPress core, WordPress plugins, and WordPress themes. Updates are critical and should always be done promptly, as they close security gaps and improve functionality.
• If there is a WordPress plugin or theme that is unsupported or not being updated, we remove it and/or replace it with another, since in this case if a security vulnerability is found, the developer won’t fix it.
• We also check if there is a plugin or theme that doesn’t offer automatic updates within WordPress (or requires payment/active license to receive updates), as it may not provide updates within WordPress but an update might exist that you haven’t installed.

User Management

• We check which users have access and administrator rights. We remove accounts of those who no longer need access and regularly change passwords for those with elevated privileges (e.g., administrators).

Login Security and Admin Access

• We use security measures such as 2FA (two-factor authentication), captcha on login, and access restriction from specific IPs or countries.
• We use plugins like Wordfence for protection, Hide WP Admin to hide the admin panel.

Virus Scanning

• We perform regular scans of all site files, using tools from the hosting or specialized WordPress plugins.

Basic Steps for Cleaning an Infected WordPress

Below is a list of indicative actions in case you find yourself with an infection on a WordPress website.

User and Permission Checks

• We carefully check WordPress users, ensuring no new administrator has been created that isn’t legitimate or generally any role with elevated privileges.
• Change passwords for all WordPress users with elevated privileges (e.g., administrators).

Database

• Change the password in the database and update the wp-config.php file with the new password.
• Compare the database(s) from current exports with clean/older backups to detect suspicious/malicious content.

File Checking and Cleaning

• We perform checks on basic files such as .htaccess and wp-config.php for unwanted changes.
• We check if there is a plugin or theme that is unsupported or not being updated. If there is, we remove it and/or replace it with one that is updated and supported, since if a security vulnerability has been found, the developer won’t fix it.
• We perform a scan of all files, not just WordPress files for infections (even in image folders). This scan can be done through our hosting, but also with a WordPress plugin if you prefer.
• We check our user’s crons, ensuring no unwanted cron has been added.

Managing Multiple Sites

• If you manage more than one WordPress site on the same user, make sure to apply these checks to all sites simultaneously.

File Integrity Check Tools

• We use the wp-cli tool (offered by our hosting) to check if WordPress core files have been modified (wp core verify-checksums).
• We can use the command wp core download --force --skip-content to reinstall the current version of WordPress Core, so that the WordPress Core files are replaced with the originals.

Restore from Backup

• There is always the option to utilize the backups provided by our hosting to restore the site to its state before any problems or infection.