The WordPress security checklist for small businesses

The core of WordPress itself is well looked after. Only six flaws were found in it in all of 2025, all low risk. The trouble is the add-ons.

Of the 11,334 new holes found in the WordPress world in 2025, 91% were in plugins and 9% in themes. Highly exploitable flaws more than doubled (up 113%), and paid “premium” plugins now have more actively exploited flaws than free ones.¹

It isn’t only plugins. In October 2026, two serious holes in PHP, the language every WordPress site runs on, were being used in attacks within a week of being fixed. The US cyber agency CISA confirmed it.²

The WordPress checklist

• Cut your plugins. List every plugin and delete (not just switch off) anything you don’t need. Each one is a door.
• Remove abandoned plugins and themes. If a plugin hasn’t been updated in a year, or was pulled from the WordPress directory, replace it.
• Never use “nulled” plugins. Free copies of paid plugins are a favourite way to plant backdoors.
• Turn on automatic updates for WordPress, plugins and themes, and check weekly that they ran.
• Ask your host which PHP version you run. Anything no longer supported should be upgraded.
• Add a web application firewall with virtual patching, which can block attacks on a hole before you’ve updated.
• Turn on two-step login for every admin account, and limit login attempts.
• Clean out old users. Remove past staff, old agencies and any admin you don’t recognise. Give everyone else the lowest role that works.
• Switch off the built-in file editor so a stolen login can’t rewrite your code from the dashboard.
• Back up off-site, daily, and test a restore at least once. A backup you’ve never restored isn’t a backup yet.
• Watch for ownership changes. If a plugin is sold to a new company, be wary. That’s how the April 2026 backdoor spread.³
• Set up monitoring: uptime alerts, file-change alerts and Google Search Console, which emails you about security issues.

Why “just keep it updated” isn’t enough

Patchstack found the typical time from a heavily targeted flaw going public to mass attacks was five hours.¹ Ordinary hosting protection doesn’t fill the gap: in Patchstack’s testing, 87% of exploits got past typical hosting defences.⁴ And when a trusted plugin is bought and poisoned, as happened to 31 plugins in April 2026, the update itself is the attack.³

The honest question to ask

Do you actually use what WordPress gives you? If your site is a shop window (services, prices, photos, a contact form) and nobody logs in weekly to blog, you’re paying in risk and upkeep for a system you don’t need.

A static site keeps the same pages, words and photos, without the login page, plugins or database. See how the two compare.

Sources

1. Patchstack, State of WordPress Security in 2026 (2025 data). See also Search Engine Journal. ↩ ↩²

2. The Hacker News, CISA confirms active exploitation of two PHP2Shell flaws (October 2026). ↩

3. TechRepublic, Malicious WordPress plugins with backdoors compromise thousands of websites (April 2026). ↩ ↩²

4. Patchstack, Hosting security tested: 87% of vulnerability exploits bypassed hosting defences. ↩