[{"data":1,"prerenderedAt":190},["ShallowReactive",2],{"publication:en:P054":3},{"meta":4,"copy":16,"relatedArticles":152,"terms":182,"term":183,"resourceParent":184,"glossaryParent":187},{"id":5,"path":6,"kind":7,"keyword":8,"title":9,"seoTitle":8,"description":10,"incoming":11,"updated":14,"preparedOn":15},"P054","\u002Fblog\u002Fwordpress-security-checklist","article","WordPress security checklist for small businesses","WordPress security checklist for small business owners","A practical WordPress security checklist covering ownership, updates, accounts, backups and integrations. Includes acceptance checks, stop conditions and clear responsibilities.",[12,13],"\u002Fservices\u002Fwordpress-support","\u002Fservices\u002Fdigital-security","2026-11-01","2026-10-30",{"intro":17,"sections":18,"checklistTitle":96,"checklist":97,"faq":104,"sources":114,"links":123,"cta":147},"A WordPress security checklist for a small business should connect ownership, supported software, limited access, controlled changes and usable recovery. Assign an owner and an acceptance check to each area. Installing a plugin or opening the homepage is not evidence that every business workflow is protected.",[19,24,33,42,78,83,91],{"title":20,"paragraphs":21},"Start with ownership and the activity that matters",[22,23],"List the website, domain, hosting, administrator accounts, mail delivery, backups and important integrations. Record the business owner and authorized supplier for each. Keep a reference to managed credentials rather than putting secrets in the checklist. The business should know how to regain control if an individual or supplier becomes unavailable.","Next identify essential workflows: an enquiry arriving at the right destination, a purchase following the correct path or an authorized user reaching the intended content. This turns a generic security list into something the owner can evaluate. A low-traffic site can still depend on sensitive customer information or several external services.",{"title":25,"paragraphs":26,"sources":29},"Review accounts and access outside the dashboard",[27,28],"Use attributable accounts and only the permissions needed for the task. Review staff, suppliers and unused identities, including access at the hosting provider, domain registrar and connected services. Consider supported MFA and a protected recovery route. A strong login control is incomplete if an obsolete provider account can still change the same system.","Access removal needs a plan for business ownership and automation. Before disabling an account, check whether it owns files, receives recovery messages or runs an integration. Do not leave a departed person's identity in place as the undocumented owner of an essential process. Use the appropriate platform guidance and an authorized transfer or replacement.",[30],{"label":31,"url":32},"OWASP: authorization controls","https:\u002F\u002Fcheatsheetseries.owasp.org\u002Fcheatsheets\u002FAuthorization_Cheat_Sheet.html",{"title":34,"paragraphs":35,"sources":38},"Use supported components and make updates testable",[36,37],"Know where core software, the theme and plugins come from, which versions run and who receives security notices. Remove unnecessary components through an appropriate change plan, not a blanket deletion rule. A popular or paid plugin is not a guarantee that its current version has no security problems.","Before a material update, define backup and rollback conditions, appropriate staging and the functions to check. Record what was updated and the observed result. An update status of successful does not prove that forms deliver, a role is restricted correctly or a shop completes its agreed checkout path.",[39],{"label":40,"url":41},"WordPress: hardening guidance","https:\u002F\u002Fdeveloper.wordpress.org\u002Fadvanced-administration\u002Fsecurity\u002Fhardening\u002F",{"title":43,"paragraphs":44,"table":47},"Check recovery and integrations before you need them",[45,46],"Identify what a backup contains, its recovery point, where it is held and who can restore it if the normal administrator is unavailable. A second copy under the same broad administrative identity may not provide the separation you expected. Test the agreed activity in an appropriately isolated environment and record exclusions.","Map website mail, CRM, webhooks, payment, analytics and other connections. Check their owners and required permissions without exposing the credential values in the checklist. A copied test site can retain production integrations. Avoid real messages or financial actions when a synthetic, controlled route can answer the question.",{"caption":48,"headers":49,"rows":53},"A practical ownership and acceptance checklist",[50,51,52],"Area","Owner to identify","Acceptance question",[54,58,62,66,70,74],[55,56,57],"Domain and hosting","Authorized business owner","Can the business recover administrative control?",[59,60,61],"Accounts","Platform administrator","Are roles and recovery routes appropriate?",[63,64,65],"Updates","Website maintainer","Did the agreed workflows work after the change?",[67,68,69],"Backup","Recovery owner","Was the required activity restored in isolation?",[71,72,73],"Integrations","Business and technical owners","Do intended actions work without excess access?",[75,76,77],"Alerts","Named recipient and backup contact","Who can interpret and act on the signal?",{"title":79,"paragraphs":80},"Apply network controls without assuming they repair the application",[81,82],"HTTPS protects the relevant connection; it does not prove the application has no vulnerable code. A WAF or plugin can add useful filtering or detection, but its location, configuration and response process determine what it actually covers. Keep those controls distinct from component repair, account management and recovery.","If a legitimate action is blocked, identify the relevant request and rule before changing protections. Avoid opening broad exceptions for the whole application just to make one test pass. After a change, check that the intended action works and that the necessary restriction still applies within the agreed scope.",{"title":84,"paragraphs":85,"example":88},"Turn observations into a record and a next action",[86,87],"For each area, write down what was checked, when, by whom and with which evidence. Use separate results for passed in scope, failed, not tested and not applicable with a reason. A task that could not be checked must not silently become green. Give unresolved work an owner and a date for the next decision.","Review frequency should fit the system and the trigger. A monthly review is not a reason to leave an exposed secret or urgent security notice until next month. A new supplier, plugin, checkout or account change may require a targeted check even when the routine checklist was completed recently.",{"title":89,"text":90},"Illustrative completion rule","The maintainer updated a plugin and the homepage opens. The checklist stays open until the agreed contact-form delivery check is recorded. This is a decision example, not evidence of a test performed on your site.",{"title":92,"paragraphs":93},"When to stop routine work and ask for help",[94,95],"An unknown administrator, unauthorized redirect, changed payment destination or confirmed unwanted code calls for an incident process. Preserve observations and coordinate with the authorized owner before routine cleanup or rollback destroys useful evidence. Do not use this preventive checklist as a recipe to investigate a live intrusion on your own.","CyberFixCrew is an Israeli cybersecurity company that scopes website-security work for businesses worldwide. You can use this checklist with your existing supplier or discuss a specific gap with us. Agreed access, changes and acceptance remain essential; the checklist is not certification, a complete penetration test or a promise against every incident.","A usable checklist has these completion rules",[98,99,100,101,102,103],"Every important asset and activity has an authorized owner.","Access covers hosting, domains and integrations, not just WordPress users.","Changes have a recovery route and business acceptance checks.","Backup availability and tested recovery are recorded separately.","Unverified items stay visible with a follow-up owner.","A current incident moves into an appropriate response process.",[105,108,111],{"question":106,"answer":107},"Is a security plugin enough for a small site?","It can provide useful controls, but does not take ownership of every account, supplier, integration and recovery decision. Check the actual capabilities and who acts on findings.",{"question":109,"answer":110},"Do I need to perform all checks myself?","No, the business owner can coordinate ownership and expected results while authorized technical suppliers perform the tasks that require specialist access or judgement. Do not make production changes you cannot safely assess.",{"question":112,"answer":113},"What counts as a completed task?","A defined check with an observed result and appropriate evidence within its scope. Installing a component or receiving a backup success message alone does not confirm every dependent workflow.",[115,116,117,120],{"label":40,"url":41},{"label":31,"url":32},{"label":118,"url":119},"NIST SP 800-209: storage security and recovery","https:\u002F\u002Fcsrc.nist.gov\u002Fpubs\u002Fsp\u002F800\u002F209\u002Ffinal",{"label":121,"url":122},"WooCommerce: testing orders and integration side effects","https:\u002F\u002Fwoocommerce.com\u002Fdocument\u002Fmanaging-orders\u002Ftesting-orders\u002F",[124,127,129,132,135,138,141,144],{"path":125,"label":126},"\u002Fservices\u002Fwordpress-security","Scope a WordPress security service",{"path":12,"label":128},"Maintain the existing WordPress installation",{"path":130,"label":131},"\u002Fblog\u002Fbackup-restore-test","Test recovery safely",{"path":133,"label":134},"\u002Fblog\u002Femployee-offboarding-access","Review departed-employee access",{"path":136,"label":137},"\u002Fblog\u002Fwebsite-hacked-first-steps","Respond to suspected compromise",{"path":139,"label":140},"\u002Fcare","Review ongoing maintenance options",{"path":142,"label":143},"\u002Fblog\u002Fwordpress-plugin-vulnerability-response","Respond to a plugin vulnerability notice",{"path":145,"label":146},"\u002Fblog\u002Fwp-staging-vs-production","Plan staging isolation and a controlled release",{"title":148,"description":149,"button":150,"type":151},"Turn an identified gap into an agreed task","Tell us the website, the item you cannot verify and who maintains it. We will clarify a practical next step.","Discuss a WordPress security gap","check",[153,161,167,175],{"id":154,"path":155,"title":156,"description":157,"category":158,"artwork":158,"order":159,"publishedOn":160},"P048","\u002Fblog\u002Fwordpress-malicious-redirect","WordPress site redirecting to another site: trace the source","Trace unwanted WordPress redirects across DNS, server rules, plugins and browser scripts. Preserve evidence, contain exposure and verify the repaired visitor paths.","websites",83,"2026-10-26",{"id":162,"path":136,"title":163,"description":164,"category":158,"artwork":158,"order":165,"publishedOn":166},"P047","My website has been hacked: what should I do first?","A practical first-response guide for a suspected website compromise: document symptoms, coordinate containment, protect evidence and plan recovery without overwriting new data.",99,"2026-11-05",{"id":168,"path":169,"title":170,"description":171,"category":158,"artwork":172,"order":173,"publishedOn":174},"threats","\u002Fblog\u002Fautomated-attacks-small-business","Automated Cyberattacks on Small Business Websites","Automated cyberattacks probe public websites for exposed software and weak account access regardless of company size. Start by identifying affected components, applying relevant updates, protecting administrator logins and checking independent backups. A vulnerability notice helps prioritize investigation; it does not prove that your website has been compromised.","security",106,"2026-04-19",{"id":176,"path":177,"title":178,"description":179,"category":158,"artwork":158,"order":180,"publishedOn":181},"updates","\u002Fblog\u002Fwhy-website-updates-matter","How to Update WordPress Safely","To update WordPress safely, check theme, plugin and PHP compatibility, back up files and the database, and prepare a recovery procedure before changing versions. After the update, test login, forms and checkout. Pause when a critical dependency is incompatible or recovery has not been prepared.",107,"2026-04-21",[],null,{"path":185,"label":186},"\u002Fresources","Website security resources and templates",{"path":188,"label":189},"\u002Fglossary","Cybersecurity glossary for small businesses",1794134058685]