← All articles · ScanMend · Lietuviškai

WordPress security for small businesses: a practical checklist

23 October 2026

WordPress is the most widely used website platform, which also makes it the most common target of automated attacks. WordPress core is updated regularly; most problems come from outdated plugins and themes and weak passwords.

1. Updates come first

• Make a backup before updating.
• Dashboard → Updates: update WordPress, plugins and your theme.
• On the Plugins page you can click "Enable auto-updates" for each plugin (available since WordPress 5.5).
• Delete plugins and themes you do not use – a deactivated plugin's files still stay on the server.
• If a plugin has been closed on WordPress.org, check whether it is still maintained. If not, switch to an alternative.

2. Logins

• Give every administrator a separate account, a strong unique password and two-factor authentication (the free "Wordfence" plugin, for example, offers it).
• Give administrator rights only to people who need them. Everyone else gets a suitable role, such as Editor or Author.
• Delete accounts of former employees and contractors.

3. Turn off what you do not use

• XML-RPC (xmlrpc.php) is often used for password guessing. If you do not use Jetpack or the mobile app, turn it off with the "Disable XML-RPC-API" plugin.
• The user list. By default, the WordPress REST API (/wp-json/wp/v2/users) shows usernames publicly. The "Stop User Enumeration" plugin restricts this.

4. HTTPS and security headers

In Settings → General, both addresses must start with https://. The free "Really Simple Security" plugin turns on the HTTPS redirect and fixes most mixed content. The easiest way to add security headers (HSTS, X-Frame-Options, X-Content-Type-Options, Referrer-Policy) is the "Headers Security Advanced & HSTS WP" or "HTTP Headers" plugin.

5. Backups

Back up automatically and keep the copies off the site itself: in cloud storage or on another server. Archives left in wp-content or the web root can be downloaded by anyone. Try restoring the site from a backup at least once.

6. PHP version

Tools → Site Health shows which PHP version the site runs. According to php.net, security support for PHP 8.2 ends on 31 December 2026. You can choose a newer version in your hosting panel (hPanel – Advanced → PHP Configuration, cPanel – Select PHP Version); first check that your theme and plugins support it.

7. Cookies and GDPR

If you use Google Analytics, Meta Pixel or similar tools, they should only load after the visitor consents. The free "Complianz" and "CookieYes" plugins can block tracking scripts until consent is given.

8. Monitoring

"Wordfence" (free version) checks for changed files and blocks some attacks. In addition, check your site from the outside once a month.