Almost every compromised site we clean up was breached through an out-of-date plugin, a reused password, or an administrator account that nobody needed. Fix those three and you have removed most of your risk.
Accounts
- Give people the lowest role that lets them do their job. Editors do not need administrator.
- Turn on two-factor authentication for every administrator.
- Remove accounts belonging to former staff and contractors on their last day.
- Never share one login between multiple people.
Software
- Apply security updates within days, not months.
- Delete plugins and themes you are not using — inactive code is still reachable.
- Avoid nulled or pirated premium plugins entirely. They are the single most common infection vector we see.
Server side
Our platform blocks known malicious requests at the edge, rate-limits login endpoints and disables PHP execution in upload directories by default. You do not need to configure these, but you should not undo them either.
Have a recovery plan
Know where your backups are, know how to restore them, and test a restore once. Security is partly prevention and partly being able to recover quickly when prevention fails.