October is Cyber Security Awareness Month, a useful reminder to give your WordPress website a health check. It’s easy to put off an update or forget about a plugin you installed months ago. Over time, those small maintenance jobs can leave gaps in your website’s security.
With Ecenica Managed WordPress Hosting, you get our advanced AI firewall and malware scanner powered by Imunify360. Together, they help protect against active threats, while regular checks of your software and user accounts help keep your site secure.
The seven checks below are a good place to start. If you need help along the way, log in to your Ecenica account and open a ticket.
1. Keep WordPress, themes and plugins up to date
Plugins let you add features to WordPress without building them from scratch, but you need to keep them up to date. Attackers scan the web for sites running older versions with known vulnerabilities.
Check for updates each week and apply security releases as soon as you can. Include your themes in that check, even if you haven’t changed your website’s design. If you’ve customised your theme, use a child theme so you can update without losing your changes.
Your PHP version matters too. Older versions stop receiving security fixes, so check which version your site uses. PHP 8.5 is available on all Ecenica hosting plans, and we explain the benefits in PHP 8.5 Now Available: Faster WordPress, Stronger Security.
With Ecenica Managed WordPress, you can use WP Toolkit to automate updates and reduce the maintenance you need to handle yourself.
2. Remove plugins and themes you don’t use
You might deactivate a plugin after trying it and then forget it’s there. Its files remain on your server, though, so deleting software you no longer need is part of keeping your site secure.
Go through your installed plugins and themes and remove those you don’t use. Keep one default WordPress theme as a fallback.
While you’re there, check when each plugin’s developer last released an update. A gap of a year or more is a reason to check whether they still maintain it and whether you should look for an alternative.
Download plugins and themes from trusted sources. Avoid nulled copies of premium products, which can contain hidden malware.
3. Secure your logins
You can keep your software up to date and still leave your site exposed through a weak password or an account someone no longer needs.
Start with your administrator accounts. Give each one a strong, unique password and use a password manager to store it. Turn on two-factor authentication (2FA) for users who can access the admin area, and limit login attempts to restrict password guessing.
Review the accounts themselves too. Former staff, freelancers and web designers may still have access long after their work ends. Remove accounts they no longer need and check the permissions of those who remain. Someone writing blog posts may need an Author or Editor account rather than full Administrator access.
If you still use admin as a username, choose a less predictable alternative.
4. Back up and practise restoring
A backup gives you a way to recover from a failed update, an accidental deletion or a security incident. Ecenica Managed WordPress includes daily backups, but it’s worth understanding how you would restore your site before you need to.
Keep a copy somewhere other than the server your website runs on, and test a restore on a separate copy of your site. That gives you a chance to check that the backup contains what you need and that you know the steps.
Take a fresh backup before making a major change too.
5. Try updates on a staging site
It’s understandable to hesitate over an update if you’re worried it might break your website. A staging site gives you somewhere to test it.
This is a private copy of your website where you can apply updates and check that your pages and key features still work before changing the live site.
Ecenica includes staging and cloning with the BusinessPro WordPress plan. If your hosting doesn’t include staging, take a backup before each batch of updates so you have a way to recover if something goes wrong.
6. Know the warning signs
You don’t need to inspect your website’s code to spot signs that something needs attention. You may notice an unfamiliar account, an unexpected email or a change in how your site behaves.
Contact your host if you see:
- Administrator accounts you don’t recognise.
- Visitors redirecting to unfamiliar websites, including redirects that affect mobile users.
- Strange pages or foreign-language spam in Google results for your site.
- Unexplained downtime or a drop in website speed.
- Password-reset or new-account emails you didn’t expect.
- A warning about unusual activity on your hosting account.
Some of these symptoms can have other causes. Your host can help you investigate.
7. Protect your email and domain too
Your website’s security extends to the accounts you use to manage it. Someone who gains access to your email may be able to reset your passwords, while access to your domain account could let them redirect your website or email.
Use strong, unique passwords and 2FA for both accounts. Ecenica Business Email includes spam filtering and 2FA protection.
Check that your domain contact details are current so you receive renewal and security notices. Enable auto-renewal to reduce the chance of missing a renewal, and ask your registrar about a transfer lock.
[Editorial check: confirm transfer-lock availability at Ecenica and add instructions for enabling it.]
Be cautious with urgent emails about unpaid invoices, suspended services or requests to log in. Our guide to avoiding phishing scams explains what to look for.
How Ecenica protects your website
With Ecenica Managed WordPress, we provide an AI firewall and malware scanner powered by Imunify360. We use the firewall to filter malicious traffic and known attack patterns, and the scanner to check your website files for malware and flag suspicious files.
Our support team uses AI to track the latest server and operating system patches and keep the hosting platform up to date.
You can build on that protection by keeping your website’s software current and reviewing who has access.
If someone hacks your site
Contact your host’s support team as soon as you discover a problem. They can help you investigate what happened and work through the recovery.
You’ll need to secure access, change the passwords for affected accounts and identify a clean backup from before the compromise. Include your WordPress administrator, hosting, database, FTP or SSH, and email credentials in that review.
Work with your host to restore the site, update its software and remove unused plugins, themes and accounts before returning it to service.
If the incident involves personal data, assess the risk to those affected. You must notify the ICO of a reportable breach without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach poses a high risk to people’s rights and freedoms, you must inform them without undue delay. Follow the ICO’s personal data breach guidance.
Ecenica customers can contact our UK-based support team for help. Our service status page shows any platform issues.
Make time for regular checks
Use this month’s health check to catch up on outstanding maintenance, then set reminders to keep it manageable. Check for updates each week and review your user accounts and backups each month.
If you’d like help looking after your site, Ecenica Managed WordPress includes daily backups, free SSL certificates and UK-based support. Annual plans include free migration from your previous host, and monthly plans come with a 30-day money-back guarantee.
