Most breaches aren't sophisticated

Almost no small website is hacked by a genius. They are hacked by scripts scanning millions of sites for the same handful of open doors — which is excellent news, because closing those doors is boring, cheap, and listed below in order.

The mental model that makes security tractable: you are not defending against a determined attacker studying your site — you are avoiding being the softest target in a fully automated sweep. Bots probe every site on the internet, constantly, for known plugin vulnerabilities, default credentials, exposed admin pages and reused passwords from public breach lists. They do not care what your site is; they care that it answered.

That reframing changes the goal. You do not need to be impenetrable; you need the common doors shut, at which point the scripts move on to the millions of sites that didn't bother. Everything below is door-shutting, ordered by how often each door is the one used.

Keep everything updated — especially WordPress plugins

Outdated plugins are the overwhelming leader in small-site compromises — far ahead of anything involving the server. The pattern is mechanical: a vulnerability is disclosed, a patch is released, and bots begin scanning for sites that haven't applied it within hours. The vulnerable window is the risk.

The regime that works: enable automatic updates for WordPress core and for plugins (via WordPress itself or Softaculous's scheduled updates); once a month, actually look at the plugin list and delete — not just deactivate — anything unused, since deactivated code is still attackable code; and before installing anything new, check when it was last updated. A plugin abandoned for two years is a door nobody is watching.

Passwords and access

The second-commonest entry is simpler still: credentials. Three rules cover it. Unique passwords everywhere, because bots replay every public breach dump against every login form on earth — reuse means one leaked forum account opens your site. A password manager makes this free. Long beats clever: a four-word passphrase outperforms P@ssw0rd-style substitutions that cracking tools have known for decades. Two-factor on the accounts that matter: your hosting login and your registrar account outrank the site itself — whoever holds those holds everything, DNS included.

Two WordPress-specific closures while you are there: no account named admin (it is the username half of every automated guess), and limit login attempts — endless free tries is what makes brute force viable at all.

Backups: the thing you hope you never need

Backups are security because they convert catastrophe into inconvenience — a hacked, corrupted or accidentally deleted site becomes a restore instead of a rebuild. The standard that actually holds up:

Yours, not only your host's. Host backups are an operational safeguard for their infrastructure, not a contractual guarantee for your data; take your own copies and keep them somewhere that is not the same server — a failure that eats the site should not eat the backup. Automatic, because manual backups stop the week you get busy: DirectAdmin can generate full account backups, and any decent WordPress backup plugin will ship copies offsite on a schedule. Tested occasionally — a backup you have never restored is a hope, not a plan. Restore one to a subdomain once or twice a year and see it work.

A short list that covers most of it

The twenty-minute hardening pass, in one place: automatic updates on; unused plugins and themes deleted; unique passwords in a manager; 2FA on hosting and registrar accounts; no admin username and login attempts limited; automatic offsite backups with one test restore behind you; SSL active with HTTPS forced; and a handful of security headers in .htaccess — HSTS, nosniff and frame protection are copy-paste lines that close whole categories of nuisance.

That list defeats the automated sweep, which is the threat a small site actually faces. Past it, the returns curve flattens fast — security plugins with firewalls help at the margin, malware scans catch what prevention missed, but nothing on the paid tier substitutes for the boring list above. Do the boring list.