Precisely because WordPress is used on sites around the world, it is the most efficient target for attackers. What’s more, the vast majority of attacks are not humans but indiscriminate scans by automated programs, so “we’re a small company, no one targets us” does not hold. This article explains the actual intrusion routes, a priority-ordered checklist you can start on today, and the first response if you do get defaced.
The reality of intrusion routes | These three get targeted
- Vulnerabilities in outdated plugins, themes, and core — The most common intrusion route. When a vulnerability is disclosed, scans hunting for un-updated sites based on that information begin all at once. “A plugin you haven’t updated in years” is the same as an unlocked back door
- Brute-force attacks on the login screen — Because wp-login.php is in the same place worldwide, attacks that mechanically try combinations of ID and password are constantly flying in. If the username is “admin” and the password is simple, a breach is only a matter of time
- Leaked, reused passwords — Attacks that try email-and-password combinations leaked from other services. Even a complex password is meaningless if it has been reused
Put the other way, closing just these three routes prevents the vast majority of attacks.
Priority-ordered countermeasure checklist
| Priority | Countermeasure | Rough time |
|---|---|---|
| High | Update core, plugins, and themes all to the latest versions (delete, don’t update, anything you’re not using) | 30 min+ |
| High | Change all users’ passwords to long, complex ones and eliminate reuse. Abolish the “admin” user | 30 min |
| High | Automate taking backups and test once that you can restore (store a copy off the server too) | 1 hr |
| Medium | Protect the login screen — introduce two-factor authentication, limit login attempts, and if possible change the login URL or restrict by IP | 1 hr |
| Medium | Delete unneeded users and departed-employee accounts, and minimize permissions (don’t casually hand out editor-or-above to update staff) | 30 min |
| Medium | Introduce a security plugin (tamper detection, login protection, scanning) | 1 hr |
| Low | Update PHP to a supported version, and disable the file-editing feature (theme editor) | 1 hr+ |
The point is that backups are included as a “countermeasure.” No matter how much you defend, the possibility of intrusion never reaches zero. Whether you have a backup you can restore is the fork between resolving the damage with “a few hours of recovery work” and facing “a rebuild.” Note that there are a great many cases where people believe they are taking backups but have never tried the restore procedure, so be sure to rehearse it once.
An answer to “I’m afraid updating will break the site”
Most reasons for hesitating to update come from “an experience where a plugin update broke the display.” The correct response is not to stop updating, but to have a procedure: take a backup, then update, and roll back if it breaks. If you can prepare a staging environment, the ideal is to test the update there before applying it to production. Leaving updates unattended piles up a risk far larger than a momentary display glitch.
First response if you do get defaced
- Temporarily close the site — A defaced site becomes the perpetrator’s side, distributing malware to visitors or redirecting them to fraudulent sites. Stopping publication with a maintenance display or the like is the top priority
- Change every password — The WordPress admin, FTP/SSH, the database, and the server control panel—all of them. Until the intrusion route is identified, you don’t know which has leaked
- Assess the scope of infection and restore to a clean state — Restoring from a pre-defacement backup is the most reliable. Only deleting the suspicious files you happen to find tends to leave embedded backdoors, and is the textbook pattern for recurrence
- Close the intrusion route before republishing — If you restore while leaving the cause (an old plugin, etc.) unattended, you’ll be re-defaced within days. Restoration and addressing the cause are a set
Combine defenses available on the server side
In parallel with WordPress’s own settings, checking the server-side features too thickens your defense.
- WAF (Web Application Firewall) — A mechanism that blocks aggressive requests before they reach WordPress. Many major hosting providers let you enable it from the control panel, often at no extra cost, so check the setting first. It occasionally misfires on things like form submissions, so verify your main paths after enabling it
- Restricting admin access from overseas IPs — Many attacks are mechanical access from abroad. If it doesn’t interfere with operations, restricting overseas access to the login screen is a high-impact measure at zero cost
- Preserving access logs — If you are breached, logs are the only clue for tracing when, from where, and what was done. Check your server’s log retention period, and if it’s too short, consider extending it
Criteria for deciding whether to outsource maintenance
If any of the following apply, you are at the stage of considering entrusting monthly maintenance to an outside party.
- Updates and backups happen only “when a staff member notices,” and can go unattended for months
- There is no one in-house who can investigate and fix the cause when an update produces a defect
- The site is directly tied to the business, and an outage or reputational damage from defacement is not acceptable
When you do outsource, the content differs greatly depending on whether it is “update work only” or includes “tamper detection and recovery response during an incident.” Before contracting, always confirm the scope of incident response and the time to first action.
Summary | 80% of security is “updates, passwords, backups”
WordPress security is not a matter of special technology; the thorough basics of updates, passwords, and backups account for 80% of it. Start today with the three “High” items on the checklist above. At SHANNON, our WordPress maintenance and operations service takes on regular updates and backups, plus tamper and incident detection through our monitoring service and recovery response when something occurs. If your feeling is “we think we’re doing the basics, but we’re anxious about gaps,” we can also start from a security assessment that reviews your current settings.