How can I secure my WordPress site against hackers?

Follow these best practices when securing your WordPress site: Use safe plugins and themes.Make use of a firewall.Monitor your site with a security plugin.Run updates regularly.Make passwords strong and change them often.Limit login attempts.Limit access and manage user permissions.

Home • Learn • WordPress • WP Maintenance

WordPress Maintenance Starter Guide

Just like your car or home, your WordPress website needs regular maintenance to keep it performing at its best.

A WordPress site is made up of several working parts —WordPress core, themes, and plugins. These all need to be checked and updated to their latest versions on a regular basis.

WordPress’s offerings are fast-growing and expanding, with more features and functions being added and perfected almost daily. Relevant “housekeeping” will help ensure you keep pace and avoid any problems. Better yet, your website will be up-to-date and operating as the robust system your visitors and customers expect.

Read our starter guide to find out how to keep your WordPress site in prime working condition.

Why is WordPress maintenance important?
WordPress maintenance never ends
What are WordPress updates?
Impact on site speed & performance
WordPress backups
Is your site accessible?
WordPress website security
Top 8 WordPress maintenance checks [infographic]
Outsourcing WordPress maintenance
WordPress maintenance FAQs
WordPress maintenance glossary

Why is WordPress maintenance important?

The short answer? WordPress maintenance addresses technical issues that slow your site down and also helps you avert security threats, downtime, and more.

Failing to update your WordPress site opens it up to issues like:

Security weaknesses
Software instability
Decreased site speed
Lower search engine rankings
Poor user experience
Missed opportunities to take advantage of new features that enhance performance

This is why it’s important to maintain the stability of your WordPress site and make sure that all the security features are up-to-date.

WordPress maintenance — it never ends.

As with any maintenance, maintaining a WordPress site is an ongoing task. Whether it’s fixing a broken link or updating a plugin, there’s always something that needs doing.

Your WordPress site contains three types of software — core files, plugins, and a theme — all of which require regular updates to ensure continued compatibility and security. Site maintenance is more than just installing updates, though. You also need to make constant site improvements to ensure optimal site speed and performance.

We know the process of keeping your WordPress site in first-class working condition can seem overwhelming. There are so many moving parts to keep track of, so we’ve broken it all down into bite-sized chunks to make it easier to digest and manage.

What (and where) are WordPress updates?

As mentioned earlier, every WordPress website has three parts that need regular updates — the core, the theme, and the plugins. Let’s walk through the basics of each of these components.

WordPress core

WordPress core files are the foundation on which your WordPress site is built. They control its basic functionality and appearance, as well as how you administer changes.

Regular updates, bug fixes, and patches on the WordPress core software are released throughout the year to address security and maintenance issues and introduce exciting new features and performance upgrades. Installing these quickly ensures that your site’s foundation remains stable.

Which WordPress core file updates are needed?

Security releases

The top two reasons for sites being hacked are insecure passwords and outdated (vulnerable) software. WordPress regularly releases security updates to its core to fix bugs and safeguard against any vulnerabilities detected before websites can be attacked.

Software updates

WordPress developers regularly update the core software to improve how it operates. These relate to a wide range of functions, for example, improvements in the Editor, migrating from HTTP to HTTPS, or fixes to the front-end.

Continuous improvements

WordPress is constantly adding new features, releasing upgrades, and improving functionality. Whether they provide better video support in Editor or adding new default themes, the list is endless.

WordPress themes

If the core is the foundation of your site’s home, then the theme is the interior design — how do you want the inside of your house to look? One of the best things about WordPress is the easy customization options that you get with themes.

WordPress themes are used to change the layout and design of your WordPress website. Themes customize your site’s appearance, including the layout, typography, color, and other design elements.

Your chosen WordPress theme needs proper maintenance to help ensure it “plays nicely” with your site’s core files and plugins. This will also retain the look of your page templates and stylesheets on which you’ve worked so hard.

What can go wrong with outdated themes?

If you don’t update your WordPress theme, it could lead to headaches down the road. Themes updates fix bugs, improve performance, and increase security. These updates need to be installed in a timely manner to ensure your theme is performing well.

If your site is using a licensed theme, it’s essential to renew the license every year so that you can continue to receive updates and support from the theme’s developer.

Deleting unused themes

Do you have themes you’ve installed that you’re not using? You may have installed a few when you started, even finding another that you perhaps preferred. Time to get rid of them.

Here’s why you should delete unused WordPress themes:

They slow down your site.
You need to update the themes regularly when the theme developers provide an update. If you or the developer don’t update the theme, your site becomes vulnerable to security breaches.

WordPress plugins

Continuing with the home analogy, if WordPress core is a home’s foundation and your theme is the interior design of your house, then the plugins are the extras that extend your home’s use. Do you want a pool in your backyard? How about a fully-connected smart home? Solar panels on your roof?

In the same way, plugins are small pieces of software that extend your WordPress site’s functionality. They exist for many purposes, including:

Search engine optimization (SEO)
External site backups
Form building
Anti-spam protection
Lead generation

…and so much more.

Why should you update your WordPress plugins?

WordPress can’t guarantee that all plugins are free of vulnerabilities. There are tens of thousands of plugins to choose from, and the more plugins you install, the more ‘at risk’ your site could become. Having the latest WordPress plugin updates installed helps prevent functionality failures, security risks, and fatal site errors.

Auditing plugins

It’s crucial to audit your plugin collection regularly to ensure all of your software remains compatible between them and your themes. You should also deactivate and delete any unused or unnecessary plugins to improve site performance.

After you’ve updated your site, it’s a good idea to give it a quick test to make sure it’s functioning as expected. This will ensure that the new themes, plugins, or even WordPress itself haven’t introduced new functionality that adversely affects your site or changes how your site operates.

WordPress maintenance and site performance

What happens if you don’t perform regular maintenance on your car? It performs less effectively over time. The same applies to your WordPress site. Missing updates and bloating your site with unused themes and abandoned plugins contribute to poor performance and slower site speeds.

A slow website means users could leave your website before it even loads. This highlights the importance of regular WP maintenance because having fast-loading pages improves user experience (UX) and helps with SEO.

Visitors expect a fast and smooth experience of your site. They are more likely to view more pages and convert when your site is quick and easy to navigate.

Search engines like speedy sites

Google and other search engines penalize slower websites by pushing them down in the search results, meaning lower traffic to your site.

If you want more traffic, subscribers, and revenue from your website, you must stay on top of its maintenance and make it as fast as possible.

How to check the speed of your WordPress site

Did you know that your experience of your WordPress site loading can be totally different from those in other locations?

It might not feel slow on your device, but that’s because browsers like Chrome store your website in the cache and automatically prefetch it as soon as you start typing. This makes your website load almost instantly. However, a normal user visiting your site for the first time may not have the same experience.

This is why you should test the speed of your website using a tool like these:

Google Search Console: Google’s free service helps you monitor your site’s presence in Google Search results and sends you alerts when Google encounters issues on your site.
Google Analytics: Delivers site speed reports that show how quickly users can see and interact with content on your WordPress site.
GTmetrix: A website performance analytics tool that analyzes your website’s performance and provides you with a list of recommendations to improve it.

Back it up

The reality of operating a website these days is that, inevitably, something will go wrong — whether a hacker decides to compromise your site, you accidentally lock yourself out, or something happens to your servers. One of the most important things you can do for yourself before this happens is set up regular WordPress backups.

Why? Getting your site back up and running is not just time-consuming, but it can be costly as well. When you set up a WordPress backup, you can fix things quickly and have your site back up again before any major damage is done.

Offsite website backups

We recommend backing up files independently of your hosting provider. Backing up your WordPress site on an independent server will save space on your server and will ensure optimal performance for your site.

Top tips:

Make backups often, so they’re up-to-date.
Always backup your site before an upgrade/update.
Use a server backup and restoration tool.
Have external/offsite backups ready.

Is your site accessible?

Are you aware that ‘inclusivity’ extends to your WordPress site as well? Have you done everything you can so that as many users as possible can access it? This includes visually-impaired people who rely on assistive technology to navigate the web.

WordPress works hard to improve accessibility through several accessibility fixes and enhancements released with every theme update release. There are also many accessibility-ready WordPress themes from which to choose, which have been tried and tested.

After all, your ultimate goal is to get as many visitors to your WordPress website as possible, isn’t it?

Top benefits of web accessibility:

Get more visitors
Improve overall website UX
Boost SEO
Avoid lawsuits

Is your site secure?

WordPress website security should be a topic of huge significance for website owners as one weak spot is all an attacker needs.

Did you know? Google blacklists around 10,000+ websites every day for malware and around 50,000 for phishing every week.

The vast popularity and open-source nature of WordPress mean that plugins, themes, and scripts are targeted by hackers. That’s why it is so important to follow these best practices when securing your WordPress site:

Use safe plugins and themes.
Make use of a firewall.
Monitor your site with a security plugin.
Run updates regularly.
Make passwords strong and change them often.
Limit login attempts.
Limit access and manage user permissions.

http://WordPress%20Maintenance%20infographic

Top 8 maintenance checks to perform (and when to do them)

WordPress core updates

How often: Monthly

Why: While WordPress has major update release cycles every quarter, there are lots of smaller security updates released in between. Keeping up to date with the latest WordPress version mitigates known security risks and dealing with bugs that have already been fixed in the new version.

Theme updates

How often: As released by open-source developers.

Why: Installing the latest updates for your WordPress theme ensures your site is safe from known security vulnerabilities and is 100 percent optimized.

How: WordPress Dashboard — managed or automatic updates.

Installed Plugin updates and audit

How often: Update plugins as updates are released by open-source developers; audit and remove unused plugins every 2-3 months.

Why: Keeping abreast of any updates for plugins makes your site as watertight from hacks and breaches as possible. Your plugins will function optimally, and you will enjoy the benefit of any enhancements or improvements made to your plugins.

How: WordPress Dashboard — managed or automatic updates.

Web and database server updates

How often: Approximately every six months.

Why: Running regular server security patches and updates ensures your server continues to run its processes efficiently. It helps get rid of bugs that can corrupt data and slow down your system.

How: Keep current with security patches & security technology; Backup and restore.

PHP updates

How often: Every six months.

Why: Keeping updated with the latest PHP version for your WordPress site will increase your site’s speed and enhance its security.

Where: PHP is set at a server level by your web hosting company. Always back up your site, themes, and plugins before updating to a new version of PHP.

Page speed checks

How often: Monthly.

Why: Web pages perform differently across devices based on several fixable factors. Identifying which pages can load faster and how to fix them means the user experience on your site will be optimal for all pages and across mobile and desktop devices.

How: Google PageSpeed Insights · Global Content Delivery Network (CDN) · Browser caching · Mobile optimization · Image file compression.

Mobile site checks

How often: After any design updates are made to the site, otherwise every six months.

Why: Web pages need to have responsive layouts to provide the best user experience on mobile devices. They need to scale to the size of the screen a user is looking at while browsing your site, without making text or images too small or large. Installing new plugins or updating your theme could affect your site’s mobile responsiveness.

How: Use a mobile testing tool like lamdatest.com or browserstack.com to view your website on various devices, and then work with your web developer to make visual mobile adjustments, if and as needed.

Site stability checks

How often: Daily uptime monitoring.

Why: It’s important to monitor any site downtime, to ensure you are always online and accessible to the people you want to reach. This is especially important if you are selling your products online.

How: Use a service like UptimeRobot or Pingdom to notify you when your website goes offline. Better yet, find a reliable hosting provider that helps make downtime a thing of the past.

Need help?

The case for hiring a professional WordPress maintenance team.

Partnering with WordPress maintenance professionals will free you to focus on what you and your site do best. Just like letting a skilled mechanic work on your car, enlisting WordPress maintenance services will keep an eye on all your maintenance and support needs.

The benefits of outsourcing your WordPress maintenance

Free up your time

Rather spend your valuable time running and growing your business, not stressing about keeping up with all the latest requirements when it comes to your WordPress website’s accessibility, SEO, security, etc.

Enjoy peace of mind

Know that none of those tedious but important maintenance tasks will be missed, and no mistakes will be made. Find comfort realizing that everything possible is being done to guard your site against any downtime or attacks.

Ensure a fine-tuned site

WordPress maintenance professionals know best how to refine your website and are on-call to make recommendations and implement improvements along the way.

Know that everything's covered

Your theme, plugins, and core software will always remain in tip-top shape. Your site speed and performance optimizations, web security, backups, and more will all be taken care of.

Get expert WordPress maintenance support at your fingertips.

SiteCare’s team of developers and customer support specialists are standing by to help keep your WordPress site maintenance in check.

Get in touch today.

Have more questions about maintaining a WordPress site?

WordPress updates

If you can, go back to the previous version before updating or restoring your site to the most recent backup. If you don’t have this option, you’ll need to diagnose the problem then fix it. Start with your plugins, as these are often the culprits.

Yes, this feature is available in WordPress version 5.5 and above. You can turn auto-updates on for individual plugins and themes directly from the WordPress admin dashboard.

The main causes for a slow WordPress website are web hosting and bad plugins. When your web hosting server isn’t properly configured, it can hurt your website speed. If you’re using a poorly coded plugin, then it can significantly slow down your website.

What are the best plugins to optimize site speed? There are many ways to improve site speed with plugins. You can use: caching plugins, minifying plugins, lazy loading plugins, and some additional plugins that allow you to make various tweaks to your website.

Most plugins are pretty simple, but some perform complex actions that are “expensive” in terms of back-end processing and will slow a website down. In other words, you could have a quick loading website with 80 plugins, and add a single, complicated plugin and lose half a second (or more) of loading time. There is no clear answer here; it just depends on the plugins used.

Managed WordPress Hosting

A domain name is the website name that online users type into a browser to access a website on the internet. SiteCare’s domain name, for example, is sitecare.com.

Web browsers need these domain names to be translated into Internet Protocol (IP) addresses so that machines can connect and interact with each other across the internet. To be understood by other machines, IP addresses are numerical (made up of a string of numbers) and difficult to memorize, which is why domain names were created instead.

The internet’s Domain Name System (DNS) is a directory that holds records of all existing website domain names and their matching IP addresses to find resources (like web pages) online.

It is a service where the host manages all the technical aspects of running a WordPress site. This includes security, speed, WordPress updates, daily backups, and scalability.

If you don’t know much about WordPress, servers, and all the other technical tasks involved in running a website, this could be for you. It’ll save you time and stress, and your site will be safer and perform better. Also, you’ll get readily available help whenever you need it.

If you’re a beginner starting a blog, then no, you don’t need managed WordPress hosting. You can start with regular WordPress hosting. However, if you’re a small business or have a high-traffic website, it makes sense for you to get managed WordPress hosting. The decision really boils down to your needs. If you lack the technical skills, then average web hosting can become a hassle as your site grows.

WordPress development

You can do it yourself if you have the technical know-how or contact your hosting company to do it for you. Here are the steps to follow to do it manually.

First, back everything up. If you’re using a widget-enabled theme, make sure that your new theme is widget-ready; otherwise you’ll lose all of it. Also, make sure you update things like: tracking codes; RSS feeds; etc., and make the switch in maintenance mode.

Make sure you have plugins for your website that cover: SEO, site security, spam protection, firewall, contact form, Google Analytics, etc. Here is a list of the top 24 plugins for websites.

WordPress Security

Brute-force login attempts, DDOS attacks, Backdoors, Pharma hacks, SQL injections, Malicious redirects, Cross-site scripting attacks.

The WordPress Security Team resolves some security threats with automated security enhancements. These enhancements update and install automatically, with no action required from the site owner or administrator.

When a new release becomes available, a notification will appear on your site dashboard to alert you to upgrade your WordPress software.

After a manual upgrade, you will be redirected to the About WordPress screen for details of changes. You will receive an email after an automatic update has been completed detailing the changes.

Follow these best practices when securing your WordPress site:

Use safe plugins and themes.
Make use of a firewall.
Monitor your site with a security plugin.
Run updates regularly.
Make passwords strong and change them often.
Limit login attempts.
Limit access and manage user permissions.

WordPress maintenance glossary

Database

A software making it easy to store, organize, and retrieve data into other software. Also known as an organized collection of structured information, or data stored electronically in a computer system.

Database connection error

One of the most common and frightening errors that WordPress users encounter. This error means your website is no longer communicating or has access to your WordPress database, and thus your entire website goes down.

Default theme

WordPress comes with a default theme to display the front-end of the website. This is the first theme you see when you install WordPress. It’s used to showcase the features of WordPress and can be used to create basic websites.

Hacking

An attempt to exploit a computer system or a private network inside a computer. It’s the unauthorized access to or control over computer network security systems for some illicit purpose.

Hosting provider

A company that enables businesses and individuals to make their websites available through the World Wide Web. Web hosting providers‘ services will vary but usually include website design, storage space on a host, and connectivity to the Internet.

Htaccess file

A powerful website file that controls the high-level configuration of your website.

Memory limit

The maximum amount of memory your hosting server provides your website.

MySQL

A freely available open-source Relational Database Management System (RDBMS) using Structured Query Language (SQL).

SQL is the most popular language for adding, accessing and managing content in a database. It is most noted for its quick processing, proven reliability, ease, and flexibility of use.

Open-source

Computer programs that allow their source code to be accessible to everyone. WordPress is entirely open-source software; anyone can use, change, and redistribute its source code.

PHP

A general-purpose scripting language especially suited to web development.

PHP memory limit

The maximum amount of memory PHP website development can use. If you exceed it, you’ll get an error report.

Spam

Irrelevant or unwanted messages sent over the internet, typically to many users, for the purposes of advertising, phishing, spreading malware, etc.

Webserver

A computer program that stores, processes, and delivers web pages to users. This intercommunication is done using Hypertext Transfer Protocol (HTTP).

WordPress maintenance mode

A state you can place your WordPress website in so you can: perform updates, implement changes to design or content, or fix a security flaw. It replaces your website with a splash page explaining why it’s offline and when it will be live again.

Additional WordPress resources

June 30, 2021 WordPress

Need help with WordPress maintenance?

Our WordPress experts are ready to help you manage, maintain, safeguard, and improve your website.

Get in touch