1. Why WordPress sites get hacked — the actual reasons
Most WordPress compromises are not targeted attacks against your specific site. They are automated scans that find known vulnerabilities across millions of sites and exploit them at scale. Understanding the attack vectors helps you prioritise your defences.
56%
Vulnerable plugins
Outdated plugins with known security vulnerabilities are the leading cause of WordPress compromises. Many site owners update WordPress core but neglect plugins.
21%
Brute-force attacks
Automated tools attempt thousands of username/password combinations against the /wp-admin login page. Default "admin" usernames and weak passwords are primary targets.
15%
Vulnerable themes
Nulled (pirated) themes frequently contain injected malware. Even legitimate themes with unpatched vulnerabilities can be exploited long after the original developer stopped updating them.
8%
Compromised hosting
Shared hosting environments can allow cross-contamination between sites on the same server. One compromised site can affect neighbours.
Source: Sucuri 2023 Hacked Website Trend Report (approximate breakdown)
2. 10 hardening steps every UK WordPress site needs
Change the admin username
Create a new administrator account with a non-obvious username. Delete the default "admin" account. Automated attacks specifically target "admin" as the login username.
Enable two-factor authentication on all admin accounts
Install WP 2FA or the Wordfence two-factor authentication feature. Anyone with administrator access to your WordPress CMS should log in with a second factor — an authenticator app, not SMS.
Keep WordPress core, themes, and plugins updated
Enable automatic updates for minor WordPress releases (security patches). Update plugins within 7 days of release. Immediately apply any plugin update marked as a security release. Remove plugins you are not actively using.
Use strong, unique passwords for all accounts
Every WordPress account, hosting account, FTP account, and database account should have a unique password generated by a password manager (Bitwarden, 1Password). Shared or weak passwords are one of the simplest attacks to prevent.
Limit login attempts
Install Wordfence or Limit Login Attempts Reloaded to block IP addresses after repeated failed login attempts. This stops brute-force attacks from running indefinitely.
Move or protect wp-admin
Consider changing the login URL from /wp-login.php to something non-standard using WPS Hide Login. Or add HTTP authentication as a second layer before the WordPress login form appears. This eliminates the majority of automated login attacks.
Enforce HTTPS everywhere
Install an SSL certificate (most managed hosts provide free Let's Encrypt SSL) and force all traffic to HTTPS. Set HSTS headers. Mixed content warnings indicate assets still loading over HTTP — fix these.
Disable XML-RPC
WordPress's XML-RPC endpoint is a common attack vector for brute-force and DDoS amplification attacks. Unless you specifically need it (some mobile apps and Jetpack use it), disable it entirely.
Remove unused themes and plugins
Every inactive plugin and theme is a potential attack surface. Delete them entirely — deactivating is not sufficient if the files remain on the server. Run "Analyse" in Wordfence periodically to detect abandoned or vulnerable code.
Set correct file permissions
WordPress directories should be set to 755 permissions; files to 644. The wp-config.php file should be 440 or 400. Incorrect permissions (particularly world-writable 777) allow attackers who gain server access to modify files directly.
3. Security plugins — Wordfence vs Sucuri vs iThemes
Wordfence Security
RecommendedThe most widely used WordPress security plugin. The free version includes a web application firewall (WAF), malware scanner, login protection, and real-time threat defence feed (with a 30-day delay vs. Wordfence Premium). Wordfence Professional (£119/yr) provides real-time firewall rules, real-time IP blacklist, and priority support — worth it for any site handling customer data. Best choice for most small and medium UK business WordPress sites.
Sucuri Security (Cloud WAF)
Sucuri is a cloud-based service — it sits in front of your website as a Web Application Firewall, filtering malicious traffic before it reaches your server. The Sucuri Business plan (£199/yr) includes the cloud WAF, CDN, malware removal SLA, and DDoS mitigation. More effective than a WordPress-installed plugin for sites that have been previously compromised, high-traffic sites, or ecommerce sites where guaranteed malware removal response time matters.
Solid Security (formerly iThemes Security)
Solid Security Pro (£99/yr) provides strong hardening features — user privilege escalation detection, site scanner, two-factor enforcement, and brute-force protection. It is particularly useful for sites with multiple user accounts (membership sites, multiauthor blogs) where role-based security policies matter. Less strong on firewall capabilities than Wordfence.
4. Backups — the right frequency and storage strategy
A WordPress backup is only valuable if you can restore from it quickly and confidently. Most UK businesses have backups but have never tested restoring them.
| Site type | Database backup | Files backup | Retention |
|---|---|---|---|
| Brochure / content site | Daily | Weekly | 30 days |
| WooCommerce store | Every 4–6 hours | Daily | 60 days |
| Membership / high-traffic site | Hourly | Daily | 90 days |
Off-site storage is mandatory
Backups stored on the same server as your site are useless if the server is compromised or fails. Use UpdraftPlus, BackupBuddy, or Duplicator to push backups automatically to Amazon S3, Backblaze B2, or Google Drive. Many managed WordPress hosts (Kinsta, WP Engine) include automated off-site backups as part of their plan.
Test your restore process
Run a test restore to a staging environment at least every six months. Confirm the restored site is fully functional — database, media files, and plugins. A backup you have never restored is a backup you cannot trust. WebAnts includes monthly backup verification in all managed maintenance plans.
5. UK GDPR — what a breach means for your business
ICO notification requirement
Under UK GDPR, if personal data is compromised in a security incident, you must notify the Information Commissioner's Office (ICO) within 72 hoursof becoming aware, if the breach poses a risk to individuals' rights and freedoms. Failure to notify on time is itself a breach of UK GDPR.
What counts as personal data on a WordPress site
Contact form submissions (names, email addresses, phone numbers). WooCommerce customer data (delivery addresses, purchase history, payment card data if not fully tokenised by your payment gateway). User account data (usernames, emails, IP addresses in logs). Comments with email addresses. This data makes most business WordPress sites subject to UK GDPR breach notification requirements.
ICO fine structure
£17.5m
maximum fine or 4% of global annual turnover (whichever is higher) for serious breaches
£8.7m
maximum for less severe breaches (failure to implement appropriate technical measures)
Practical steps for UK GDPR compliance on WordPress
- →Document what personal data your site collects and where it is stored (your ROPA — Record of Processing Activities)
- →Ensure your privacy policy accurately describes data collection (all form submissions, analytics, cookies)
- →Implement a data retention policy — contact form submissions should not be stored indefinitely
- →Have an incident response plan — know who to contact at your hosting provider, what to capture as evidence, and how to file an ICO notification
6. Hosting — how your choice affects your security posture
Shared hosting — significant risk
On shared hosting, your site shares a server with hundreds of other sites. A compromised neighbouring site can access your files if server isolation is poor. Cheap shared hosts (GoDaddy, Bluehost at entry-tier, Heart Internet) offer minimal isolation. This is the most common scenario where a WordPress site is compromised not through its own code but through a server-level breach.
Managed WordPress hosting — recommended
Managed WordPress hosts (Kinsta, WP Engine, Cloudways) provide container-based isolation, automated daily backups, built-in CDN, and active security monitoring. Kinsta's hack guarantee means they will clean your site for free if you are compromised while hosted with them. For UK businesses, UK-region hosting on Kinsta (London data centre) or WP Engine (available on business plans) also satisfies data residency considerations under UK GDPR.
7. If you have been hacked — what to do immediately
Take the site offline or put it in maintenance mode
Prevent further data exfiltration or malware spread. Contact your hosting provider immediately — they can help isolate the compromised environment.
Reset all passwords
Every WordPress admin account, hosting account, FTP/SFTP account, and database account. Assume all credentials are compromised.
Identify the infection scope
Use Sucuri SiteCheck (free online scan) or Wordfence to identify infected files. Your hosting provider's control panel may also show file modification timestamps — check for recently modified PHP files outside of WordPress core.
Restore from a clean backup
If you have a backup predating the compromise, restore to that. Re-apply any legitimate content changes made after the backup. This is faster and more reliable than attempting to clean an infected live site.
Identify and patch the entry point
If you restore without fixing the vulnerability, you will be reinfected within hours. Identify which plugin, theme, or account was compromised and update or remove it before going back online.
Assess UK GDPR notification obligations
If personal data was accessible during the compromise period, assess whether ICO notification is required within 72 hours. Document the timeline of events.
8. Managed maintenance — is it worth it?
The case for managed WordPress maintenance comes down to one question: what is the cost of a compromised site to your business?
For a law firm or accountancy practice, a compromised website with client enquiry data leaked is a regulatory incident with ICO notification obligations and reputational consequences. For an ecommerce store, a site that is down for 24 hours costs real revenue. For these businesses, a £200–£300/mo managed maintenance plan is not an overhead — it is risk management.
What WebAnts WordPress maintenance includes
- →WordPress core, theme, and plugin updates (tested on staging before applying to live)
- →Daily off-site backups with monthly restore verification
- →Security monitoring with Wordfence Professional
- →Uptime monitoring with instant alerts
- →Monthly performance and security report
- →Priority response if something goes wrong
Plans from £200/mo. See our WordPress development service →