Update with a way to recover.
Keep WordPress, compatible PHP, themes and plugins on supported versions. Before major changes, check your backup and test in a staging environment where possible. Afterwards validate logins, forms, checkout, integrations and key pages.
Use components from trusted sources.
Install themes and plugins from the official repository or legitimate developer. Remove unused components and replace abandoned ones. Pirated or modified copies may contain malicious code; assess their origin and maintenance rather than relying on appearance or install counts.
Give each person the access they need.
Use individual accounts and reserve administrator access for tasks that require it. Revoke departed users, review unfamiliar accounts and use a compatible second factor or passkeys. Do not share one administrator password across the team.
Test restoration, not just backup existence.
Files and database need to match the same recovery point. Keep copies outside the public installation and check plan retention. Test restoration in a separate environment. An older backup may contain the same vulnerability or infection, so verify before restoring.
Look after the environment too.
Use encrypted administrative connections and secure the administrator’s device. Have a qualified person review file permissions; avoid world-writable settings. HTTPS protects traffic but does not fix vulnerable plugins, exposed passwords or outdated applications.
Recognize when it is an incident.
Unexpected redirects, unfamiliar users and malware warnings need investigation. Record symptoms and time. If compromise is suspected, follow the incident response guide before deleting files or overwriting the current state.
What have you reviewed?
Check the items you reviewed. Checkmarks stay on this page: they do not access your account or perform an audit.
Common questions.
Does a security plugin handle everything?
No. It may provide controls and alerts but needs configuration and maintenance. Updates, access, backups and hosting security still matter. Avoid duplicating controls without understanding conflicts and impact.
Does hosting maintain all of WordPress?
Scope depends on your purchased service. Hosting, application maintenance and malware cleanup are different activities. Check who manages each component and agree on responsibilities.
Further references.
Official guidance for exploring these practices further.