WordPress
When You Need a Custom WordPress Plugin (and When You Don’t)
How to decide between existing plugins and custom development, and what a well-built custom plugin looks like.
Read moreWordPress
WordPress Security Best Practices
WordPress itself is well maintained. Most compromises come from how sites are configured and maintained.
The essentials
- Keep core, themes and plugins updated
- Use only reputable, licensed plugins
- Enforce strong passwords and two-factor authentication
- Give users the minimum role they need
- Take automatic off-site backups
- Use a web application firewall
- Disable file editing in wp-admin
- Choose secure, well-managed hosting
Monitor
Set up uptime monitoring, malware scanning and alerts for new administrator accounts or file changes.
Have a recovery plan
Know how to restore a backup quickly and who to call.
Frequently asked questions
Should I hide wp-admin?
It can reduce noise from bots, but strong passwords, 2FA and rate limiting matter more.
How often should I back up?
At least daily for active sites, and always before updates.