OnWebPoint 
Table of Contents
WordPress powers approximately 43% of all websites on the internet, which makes it the most attacked web platform on the planet by volume. For Irish businesses, a compromised website is not just a technical problem — it is a GDPR compliance incident that must be reported to the Data Protection Commission within 72 hours, a reputational risk if customer data is involved, and a potential business interruption that can take days or weeks to resolve. This WordPress security checklist measures that prevent the overwhelming majority of real-world WordPress attacks.
Why WordPress Sites Are Targeted
The attacks targeting WordPress are almost entirely automated. Bots scan millions of websites continuously, testing for known vulnerable plugin versions, weak passwords, and default configurations. They do not target your site specifically — they target the pattern. Your business being small or low-profile provides no protection, because the bots do not know or care who you are. They just need a server they can exploit.
The good news is that the same automated nature of these attacks means basic, consistent WordPress security hygiene stops the overwhelming majority of them. You do not need to be impenetrable. You just need to present a harder target than the next WordPress site down the list. The checklist below addresses every significant category of automated WordPress attack — implement it and you eliminate the risk for all but the most sophisticated, targeted intrusions, which are vanishingly rare for Irish SMEs.
The 12-Step WordPress Security Checklist
1. Use a Strong, Unique Administrator Password
Twenty characters minimum, mixing upper and lower case, numbers, and symbols, not used on any other account anywhere. A password manager (1Password or Bitwarden are both excellent) makes this trivial to generate and remember. The most common attack vector against WordPress login pages is credential stuffing — trying username and password combinations leaked from other data breaches. A unique password makes this attack impossible: even if your email and password from a 2019 data breach are in a database somewhere, that combination cannot be used to access your WordPress admin.
2. Change the Administrator Username From “admin”
Every brute-force bot that targets WordPress tries “admin” as the first username. Create a new administrator account with a non-obvious username (not your own name or your business name), assign your content to the new account, and delete the original “admin” account. This single step eliminates a significant proportion of automated login attempts before they even get to the password check.
3. Enable Two-Factor Authentication for All Admins
Install WP 2FA (free, actively maintained) and require two-factor authentication for every administrator-level account. Two-factor authentication means that even if an attacker has the correct username and password, they cannot log in without the time-based code from the authenticator app. This effectively eliminates credential-based account takeover as a viable attack vector.
4. Keep WordPress Core, Themes, and Plugins Updated
The majority of successful WordPress compromises exploit known vulnerabilities in outdated plugins — vulnerabilities that are publicly documented in databases like Wordfence’s threat intelligence feed. When a vulnerability is disclosed, the race begins between attackers scanning for unpatched sites and site owners applying the update. Enable automatic updates for WordPress minor releases. For plugins, review the changelog and apply updates within a week of release on production sites — not because every update is critical, but because the discipline of staying current closes the window of exposure.
5. Remove Inactive Plugins and Themes
A deactivated plugin is still executable code on your server. If it contains a vulnerability, that vulnerability can still be exploited even when the plugin is switched off. Delete every plugin and theme you are not actively using. WordPress ships with several default themes (Twenty Twenty-Four, Twenty Twenty-Three, and so on) that most sites never use — delete them. The principle is simple: code you are not running cannot be compromised.
6. Protect the WordPress Login Page
The default /wp-admin/ and /wp-login.php URLs are targeted by bots constantly. Two practical approaches: relocate the login URL using WPS Hide Login (free, moves the URL to something non-standard), or restrict the default URL to specific IP addresses in your .htaccess file. The IP restriction approach is more robust — it means that even if the URL is discovered, only you can access it. Either approach stops automated login attacks without affecting legitimate admin access.
7. Choose a Hosting Provider With Server-Level WordPress Security
Your hosting environment is the first line of defence. Managed WordPress hosts — SiteGround, Kinsta, WP Engine — include server-level firewalls, malware scanning, and automatic malware removal as part of their standard packages. Budget shared hosting typically includes none of these. If your site handles any customer data — contact form submissions, WooCommerce orders, newsletter subscribers — managed WordPress hosting is not a luxury. The difference in cost between budget shared hosting and managed WordPress hosting is typically €100–200 per year. The cost of recovering from a compromise on underpowered hosting is typically €500–2,000 in developer time, plus the reputational cost, plus the GDPR incident reporting obligation.
8. Install a WordPress Security Plugin
Wordfence (free and paid) is the most widely used WordPress security plugin and provides meaningful protection at the free tier: login attempt limiting, which blocks an IP address after a defined number of failed logins; file change monitoring, which alerts you if plugin or theme files are unexpectedly modified (a classic sign of compromise); and on-demand malware scanning. Configure all three features after installation and set the scan to run weekly at minimum.
9. Set Up Daily Offsite Backups and Test Them
A backup stored on the same server as the site it backs up is not a useful backup — if the server is compromised, both the site and the backup are affected simultaneously. UpdraftPlus configured with remote storage (Google Drive, Dropbox, or Amazon S3) running on a daily schedule is the standard approach for Irish WordPress sites. The element most often skipped: test a restore. Restore a backup to a staging environment at least once per quarter. If you have never successfully restored from a backup, you do not know whether your backup actually works.
10. Enable HTTPS With HSTS
HTTPS encrypts the connection between your server and your visitors’ browsers, protecting data in transit. HTTP Strict Transport WordPress Security (HSTS) takes this further by telling browsers to always use HTTPS for your domain even if a user types http:// manually. Add the HSTS header via your .htaccess file or through your WordPress security plugin. SiteGround enables HTTPS automatically for all hosted sites; on other hosts it typically requires a one-click activation from the control panel.
11. Disable XML-RPC if Not Required
XML-RPC is a legacy WordPress API used by mobile apps and some third-party integrations. Most WordPress sites do not need it, and it is a frequent target for brute-force attacks because it allows multiple authentication attempts in a single request (unlike the login page, which processes one at a time). Disable it by adding add_filter('xmlrpc_enabled', '__return_false'); to your functions.php, or by using your WordPress security plugin’s toggle. Before disabling, confirm nothing in your workflow depends on XML-RPC — Jetpack, some publishing tools, and certain backup plugins use it.
12. Audit User Accounts Quarterly
Open Users in your WordPress dashboard and remove any accounts that should no longer have access: former employees, past contractors, web developers whose projects ended months ago. Each inactive account with a weak password is an entry point. Set a recurring calendar reminder to audit this quarterly — it takes five minutes and removes a meaningful category of risk.
WordPress Security Breaches and GDPR in Ireland
Under GDPR as applied in Ireland, a WordPress security breach that involves personal data — customer email addresses, order details, contact form submissions — must be reported to the Data Protection Commission within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to individuals’ rights (for example, if payment data or sensitive personal information was exposed), you must also notify the affected individuals directly. Failure to report is an additional GDPR violation on top of the breach itself. The practical implication: implement monitoring that tells you quickly if something is wrong, so the 72-hour clock starts from the earliest possible point where you can actually act on the information.
If Your WordPress Site Is Already Hacked
Take the site offline immediately using your hosting control panel’s suspend option. Do not attempt to clean it while it remains live — you risk re-infecting cleaned files from malicious code still running on the server. Restore from your most recent clean backup (this is why the backup step is non-negotiable). If you do not have a clean backup, use a professional malware removal service — Sucuri and Wordfence both offer this. Change every password associated with the site after restoration: WordPress admin, hosting cPanel, database, SFTP/FTP, and any connected third-party services. Identify how the attacker got in before relaunching — restoring a compromised site without closing the entry point means you will be compromised again within days.
Which WordPress Security Plugin to Use
For most Irish small business websites: Wordfence free tier. It provides login protection, file integrity monitoring, and malware scanning without cost, and the interface is approachable for non-technical users. For WooCommerce stores or any site handling payment or sensitive customer data: Wordfence Premium or a dedicated security monitoring service adds real-time threat intelligence and faster vulnerability response. For high-traffic or high-value sites: server-level security through a managed WordPress host combined with Wordfence is more robust than any plugin-only approach. The host-level firewall blocks attacks before they reach WordPress at all, which is more efficient than blocking them inside the application.
If you are not confident how secure your WordPress site currently is, we offer a security review for Irish businesses. It takes about fifteen minutes and we will give you an honest list of what needs to be addressed. Request a free security review →
