The Spring Clean Security Checklist for WordPress Websites
Spring is a good time to give your website a proper check up. This WordPress security checklist covers the essentials every small business should review. WordPress powers a huge share of websites, which makes it a popular target for hackers. The good news is that most attacks can be prevented with some basic care.
At KIVEIN we clean up hacked WordPress websites regularly. In almost every case, the problem started with something on this list.
Why hackers target small business websites
Many owners think “who would want to hack my little website?” But most attacks are automated. Bots scan thousands of sites looking for weak passwords and outdated plugins. They do not care how big your business is.
Once inside, hackers may add spam links, redirect your visitors to gambling or scam sites, steal customer data or use your server to send spam. Google may then flag your site as unsafe, which can wipe out your search traffic overnight.
The checklist
1. Update WordPress, themes and plugins
Outdated plugins are the most common way hackers get in. Log in and update everything. If a plugin has not been updated by its developer in over a year, consider replacing it.
2. Delete what you do not use
Old themes and deactivated plugins can still be exploited. If you are not using it, delete it.
3. Check your user accounts
Go to Users and review every account. Remove old staff, former developers and anyone who no longer needs access. Look out for admin accounts you do not recognise. That is a warning sign.
4. Use strong passwords and two factor authentication
Every admin account should have a long, unique password. Add two factor authentication so a stolen password alone is not enough.
5. Make sure backups are working
Do not just assume backups are running. Check when the last one was taken and where it is stored. Ideally keep copies off your server, so a hack cannot delete them too.
6. Check your SSL certificate
Your website address should start with https and show a padlock. Without it, browsers warn visitors that your site is not secure.
7. Review your forms
Contact and booking forms are often abused by spam bots. Add spam protection and make sure form emails are arriving properly.
8. Scan for malware
Use a reputable security plugin or your host’s scanning tool. Look for unfamiliar files, strange redirects or pages you did not create.
9. Search for your own website
Type site:yourdomain.co.uk into Google. Look through the results. If you see pages about gambling, pharmacy or anything unrelated to your business, your site may be hacked.
10. Check who can access your hosting
Review logins for your hosting account, domain registrar and any FTP accounts. Change passwords if former staff or suppliers had access.
Signs your website may already be hacked
- Visitors are redirected to other websites
- Google shows a “this site may be hacked” warning
- Strange pages appear in Google search results
- Your site suddenly becomes very slow
- Your host suspends your account
- Admin users appear that you did not create
If you notice any of these, act quickly. The longer malware stays, the more damage it does to your reputation and search rankings.
Prevention is cheaper than the cure
Cleaning a hacked site takes time and money. Regular maintenance costs far less. Even 30 minutes a month working through this checklist puts you ahead of most small business websites.
Frequently asked questions
How often should I update WordPress plugins?
Check for updates at least once a month. Security updates should be applied as soon as possible.
How do I know if my WordPress site has been hacked?
Common signs include unexpected redirects, Google warnings, unknown admin users, spam pages in search results and a sudden slowdown.
Can a hacked WordPress website be fixed?
Yes. Malware can be removed and the site secured. It is important to also find and close the way the hacker got in, so it does not happen again.
Talk to KIVEIN
Think your website might be at risk, or already hacked? KIVEIN provides WordPress malware removal and website maintenance for businesses across the UK. Get a free quote today.