WordPress Security: Hardening Your Business Site

WordPress powers a large share of business websites in Belgium, and its popularity makes it a prime target for attackers. Automated bots scan the internet continuously for vulnerable WordPress installations, and an unsecured site can be compromised within hours of being discovered. This guide covers the essential security hardening measures every Belgian business running WordPress should implement.

Why WordPress Sites Get Hacked

Understanding the common attack vectors helps you prioritise your defences:

• Outdated software — the number one cause of WordPress compromises. Outdated core, themes, and plugins contain known vulnerabilities that automated tools exploit at scale.
• Weak credentials — brute force attacks against wp-login.php are constant. Sites using "admin" as a username or simple passwords are compromised routinely.
• Vulnerable plugins — third-party plugins account for the vast majority of WordPress security issues. Even popular plugins with millions of installations have had critical vulnerabilities.
• Insecure hosting — shared hosting environments where one compromised site can affect others, outdated PHP versions, and lack of server-level protections.
• File upload vulnerabilities — poorly coded themes or plugins that allow arbitrary file uploads give attackers a direct path to your server.

Core Security Hardening Measures

Implement these foundational security measures on every WordPress installation:

1. Keep everything updated — enable automatic updates for WordPress core minor releases. Update themes and plugins within 48 hours of new releases. Remove any unused themes and plugins entirely, do not just deactivate them.
2. Use strong, unique passwords — enforce complex passwords for all user accounts. Use a password manager. Never reuse passwords across services.
3. Enable two-factor authentication — add 2FA to all administrator and editor accounts using plugins like WP 2FA or Wordfence. This single measure blocks the vast majority of brute force attacks.
4. Change the default admin username — create a new administrator account with a non-obvious username, then delete the default "admin" account.
5. Limit login attempts — block IP addresses after a set number of failed login attempts. Most security plugins include this feature.
6. Move or protect wp-login.php — change the login URL or add HTTP authentication in front of the WordPress login page to stop automated attacks.

Server and Hosting Security

Security starts at the server level. Ensure your hosting environment is properly configured:

• Use managed WordPress hosting — providers like Kinsta, WP Engine, or Cloudways offer server-level firewalls, malware scanning, and automatic backups specifically optimised for WordPress.
• Run a current PHP version — use PHP 8.1 or newer. Older PHP versions no longer receive security patches and expose your site to known vulnerabilities.
• Disable file editing — add define('DISALLOW_FILE_EDIT', true); to wp-config.php to prevent the built-in theme and plugin editor from being used if an admin account is compromised.
• Protect wp-config.php — move wp-config.php above the web root if your host supports it, or add server rules to deny direct access to this file which contains database credentials.
• Set correct file permissions — directories should be 755, files should be 644, and wp-config.php should be 600 or 640. Never use 777 permissions.
• Disable XML-RPC — unless you specifically need it for Jetpack or mobile apps, disable XML-RPC to prevent it being used for brute force amplification attacks.

Security Plugins and Monitoring

A security plugin adds multiple layers of protection. Choose one comprehensive solution rather than stacking multiple plugins:

• Wordfence — offers a web application firewall, malware scanner, login security, and real-time threat intelligence. The free version is solid; the premium version adds real-time firewall rules and country blocking.
• Sucuri Security — provides file integrity monitoring, security hardening, and post-hack cleanup tools. Their cloud-based firewall (paid) filters malicious traffic before it reaches your server.
• iThemes Security — good for basic hardening measures like hiding the login page, enforcing strong passwords, and detecting file changes.
• Activity logging — install an activity log plugin to track who logged in, what content was changed, and what plugins were installed. This is invaluable for both security auditing and GDPR accountability.

Backup Strategy

Backups are your last line of defence. A good backup strategy lets you recover quickly from any security incident. If the worst happens, having clean backups is essential to the WordPress hack recovery process:

1. Automate daily backups — use a plugin like UpdraftPlus or BlogVault to create automatic daily backups of both files and database.
2. Store backups offsite — never store backups only on the same server as your website. Use cloud storage (Amazon S3, Google Cloud Storage) or a separate backup service.
3. Test restoration regularly — a backup is useless if you cannot restore from it. Test your restoration process at least quarterly.
4. Retain multiple versions — keep at least 30 days of backups. Some malware can remain dormant for weeks before activating, and you may need to restore from a backup predating the infection.
5. Include the database — ensure your backup includes both the WordPress files and the MySQL database. A files-only backup is incomplete.

GDPR and Belgian Compliance Considerations

WordPress security is also a compliance matter for Belgian businesses:

• Data breach notification — under GDPR, you must report data breaches to the Belgian Data Protection Authority within 72 hours. A compromised WordPress site that stores customer data constitutes a reportable breach.
• Data minimisation — only collect and store personal data you genuinely need. Reduce your risk surface by removing unnecessary contact form fields and limiting data retention periods.
• Security as a GDPR requirement — Article 32 of GDPR requires appropriate technical measures to protect personal data. An unpatched WordPress site with default settings does not meet this standard.

How ICTLAB Can Help

ICTLAB's cybersecurity team provides WordPress security audits and hardening services for Belgian businesses. We assess your current WordPress installation against security best practices, implement hardening measures, and set up monitoring to detect and respond to threats. For businesses outgrowing WordPress, our web development team builds modern, secure websites using headless CMS architectures that eliminate many of the security risks inherent to traditional WordPress installations.

Related reading: understand the cost of a security audit in Belgium, learn about web application security best practices, or explore vulnerability scanning vs penetration testing to choose the right assessment for your WordPress site.