webs.me.uk UK web hosting directory

Home → Guides → Securing and backing up a WordPress site properly

Intermediate 11 min read

Securing and backing up a WordPress site properly

The realistic threat model, the 3-2-1 backup rule applied to a small site, and the hardening that gives you most of the benefit for very little effort.

The actual threat model

Nobody is targeting your plumbing company's website personally. What is happening is automated: bots continuously scan every IP address for known-vulnerable plugin versions, weak passwords and exposed files. Almost every WordPress compromise comes from one of three things — an out-of-date plugin, a reused password, or an insecure host neighbour. Defend against those and you have handled the realistic risk.

The high-value, low-effort list

  1. Update weekly. Core, plugins, themes. Enable auto-updates for plugins from vendors you trust. Delete plugins you are not using — deactivated plugins are still files on disk and can still be exploited.
  2. Unique passwords plus two-factor. A password manager and a 2FA plugin (Wordfence Login Security, WP 2FA) close off credential stuffing entirely.
  3. No user called "admin", and no account with Administrator rights that does not need it. Editors should be Editors.
  4. Limit login attempts. Wordfence, Solid Security or Limit Login Attempts Reloaded. Cheap and effective.
  5. Disable the file editor: define('DISALLOW_FILE_EDIT', true); in wp-config.php. It stops a stolen admin session from becoming remote code execution in two clicks.
  6. Block PHP execution in uploads. The single most common way a file-upload bug becomes a shell. On nginx: location ~* /uploads/.*\.php$ { deny all; }.
  7. HTTPS everywhere, with HSTS once you are confident.
  8. Keep PHP current. PHP 8.1 and earlier are end of life. Old PHP is unpatched PHP.

Backups: the 3-2-1 rule for a small site

Three copies, on two kinds of media, one off-site. In practice:

CopyWhereHow often
1 — liveThe site itselfContinuous
2 — host backupYour host's automatic daily backupDaily, 14–30 days retention
3 — your own off-site copyBackblaze B2, Cloudflare R2, Google Drive — an account your host does not controlDaily or weekly, 90 days

Copy 3 is the one that matters. If your host has a billing dispute with you, suffers a ransomware event, or goes under, copies 1 and 2 vanish together. UpdraftPlus sending to your own storage account costs nothing and takes ten minutes to set up.

Test a restore. Once a quarter, restore into a staging site and click around. Backups fail silently far more often than anyone expects — a database export that stopped completing three months ago looks exactly like a healthy one in a file listing.

If you are hacked

  1. Take the site offline or into maintenance mode. Do not "clean it while it runs".
  2. Change every password: WordPress admins, hosting panel, SFTP, database, and any reused elsewhere.
  3. Restore from a backup predating the compromise — check when suspicious files first appeared, not when you noticed.
  4. Update everything before putting it back online, or you will be reinfected within the day.
  5. Look for persistence: unexpected admin users, modified wp-config.php, files in uploads with a .php extension, unknown scheduled tasks (wp cron event list).
  6. If card or personal data may have been exposed, you have UK GDPR obligations — potentially an ICO report within 72 hours. Take advice early.