A WordPress website is secure when its software is up to date, each account has only the access it needs, logins are protected by more than a password, and a recent backup is kept away from the website’s own server. A security plugin helps with all of these, but does not replace any of them.
Most break-ins start with a plugin rather than with WordPress itself. Of the 11 334 new vulnerabilities that Patchstack found in WordPress software in 2025, 91% were in plugins and 9% in themes, while only six were in WordPress itself. For an LGBTQ+ organisation, a break-in can also expose the names and email addresses of members who are not out to everyone.
Why do updates matter for WordPress security?
An update closes a vulnerability once the developer has fixed it, so your website is at risk from the moment a vulnerability is made public until the update is installed. In 2025, 46% of the vulnerabilities had no fix at the time they were made public. A plugin that is no longer maintained never receives that fix, which is why such a plugin should be removed rather than kept.
Read Updating WordPress and plugins safely and Choosing and removing WordPress plugins.
Who needs an administrator account on your WordPress website?
An administrator account is only needed by the people who maintain the website. An administrator can install plugins, change any setting and add other administrators, so every administrator account is a way into the whole website. Someone who writes, edits and publishes posts and pages needs the ‘Editor’ role, and someone who only writes and publishes their own posts needs the ‘Author’ role.
Check the list of users at least once a year and remove the accounts of volunteers and staff who have left. A forgotten account with an old password is easy to overlook, because nobody uses it and nobody notices when someone else does.
How should passwords and logins be set up in WordPress?
Give every person their own account, with a password that they do not use anywhere else. A shared login cannot be taken away from one person without changing it for everyone. A password manager creates and remembers a password that is long enough.
WordPress has no two-factor authentication of its own, in which a code from an app on your phone is needed in addition to the password. A security plugin adds it. Turn on two-factor authentication for every administrator account at least, as these are the accounts an attacker is looking for.
What does a WordPress security plugin do?
A security plugin limits the number of failed login attempts, blocks known attacks and warns you when files on your website change, which is worth having on most websites. Install one security plugin, not several, as security plugins that do the same work can interfere with each other. Ask your hosting provider first, as part of this protection may already run on the server.
Where should backups of a WordPress website be kept?
Keep backups away from the server on which the website runs. A backup that is stored on the same server is lost along with the website if the server fails or the website is hacked. Keep backups from several dates, because a hack is often discovered only weeks after it happened, by which time the most recent backups contain the hack as well.
A backup has only been proven to work once it has been restored. Ask your hosting provider how backups are made and how long a restore takes.
Would you like us to check who has access to your website and how it is backed up? Send us an email at hello@fourteenrockets.com.