Start with access
Most breaches are access problems dressed up as technical ones. Before buying a security plugin, fix who can log in.
- One account per person, never a shared 'admin' login
- Two-factor authentication on hosting, DNS, email and CMS
- Remove ex-staff and ex-agency accounts the day they leave
- Editors get editor roles, not administrator
Keep the stack current
Updates are the boring core of security. The fix is a schedule and a staging site, so updating stops being scary.
- Patch core, plugins and themes on a fixed weekly slot
- Test on staging, then push to production
- Delete plugins you disabled instead of leaving them installed
- Track end-of-life PHP and database versions with your host
Backups you have actually restored
A backup you have never restored is a hope, not a plan. Run a restore drill once a quarter into a staging environment and time it.
- Daily automated backups stored off the web server
- At least 30 days of retention
- Documented restore steps anyone on the team can follow
- A tested quarterly restore drill
Hardening and monitoring
Once access, updates and backups are handled, hardening is quick and high value.
- HTTPS everywhere with HSTS and secure cookies
- A web application firewall or CDN-level rules
- Disable file editing from the CMS admin
- Rate-limit login and form endpoints to stop credential stuffing
- Uptime and file-integrity monitoring with alerts to a real inbox
If you are already compromised
Do not just delete the visible defacement. Rotate every credential, restore from a known-clean backup, patch the entry point, then scan again — otherwise the reinfection arrives within days.