How to Speed Up a WordPress Website (2026 Guide)
Hosting, caching, images, plugins and scripts, fixed in the order that matters most.
Read articleIn this guide
Key takeaways
- Most hacked WordPress sites are running outdated plugins, themes or core.
- Strong passwords and two-factor authentication stop most login attacks.
- Automatic, off-site backups are your safety net when everything else fails.
- Security is ongoing maintenance, not a one-off setting.
Why WordPress sites get hacked
WordPress itself is well maintained, but it powers a huge share of the web, which makes it a popular target for automated attacks. Most successful attacks don't target you personally: bots scan thousands of sites for known weaknesses, such as an outdated plugin or a weak password, and exploit whatever they find.
That means a simple WordPress security checklist, followed consistently, protects you from the vast majority of attacks.
1. Keep everything updated
- WordPress core: install updates promptly, especially security releases.
- Plugins and themes: update regularly, and remove any you don't use.
- PHP version: run a version that still receives security updates.
- Abandoned plugins: replace plugins that haven't been updated for a long time.
Update safely: take a backup first, update on a staging copy for big changes, and check your forms, checkout and key pages afterwards.
2. Lock down logins
- Use strong, unique passwords stored in a password manager.
- Turn on two-factor authentication for every administrator.
- Limit login attempts to slow down password-guessing bots.
- Give each person their own account with only the access they need. Most people don't need to be administrators.
- Remove old accounts for former staff and suppliers.
3. Back up automatically
- Daily automatic backups of files and database (more often for busy shops).
- Store copies off-site, not only on the same server as the website.
- Keep several versions, so you can restore from before a problem started.
- Test a restore occasionally. A backup you can't restore isn't a backup.
4. Choose secure hosting and settings
- Reputable hosting with server firewalls, malware scanning and isolation between sites.
- HTTPS everywhere with a valid SSL certificate.
- A web application firewall (from your host, a CDN or a security plugin) to block common attacks.
- Disable file editing in the WordPress dashboard, so a stolen login can't be used to change code.
- Correct file permissions and no unused software left on the server.
Never use nulled themes or plugins. "Free" copies of premium software often contain hidden malware. Buy from the original developer, or choose a free alternative from WordPress.org.
5. Monitor and respond
- Uptime monitoring that alerts you if the site goes down.
- Malware and file-change scanning from your host or a security plugin.
- Activity logs showing who changed what, and when.
- Google Search Console alerts for security issues and manual actions.
Want a security health check?We'll review your WordPress site and give you a prioritised list of fixes.
Get my free audit If your site is hacked
- Don't panic, and don't delete anything yet.
- Contact your host; many can help isolate and clean the site.
- Change all passwords: WordPress, hosting, database, FTP and email.
- Restore a clean backup from before the attack, or have the site professionally cleaned.
- Find and fix how they got in, usually an outdated plugin or a weak login.
- Check Search Console and request a review if Google has flagged the site.
If customer personal data may have been exposed, UK GDPR requires you to report a qualifying breach to the Information Commissioner's Office within 72 hours of becoming aware of it, and in some cases to tell the people affected.
Common mistakes
- Everyone sharing one admin login.
- Dozens of inactive plugins left installed.
- Backups stored only on the same server.
- Ignoring update notifications for months.
- Using the same password for hosting, email and WordPress.
Security and speed go hand in hand: fewer, well-maintained plugins make a site both safer and faster. See our guide to speeding up WordPress.
WordPress security FAQs
Do I need a security plugin?
It helps on most sites, especially for login protection, firewall rules and scanning. If your host already provides these, avoid duplicating features with several plugins.
Is WordPress less secure than Shopify?
Shopify manages security for you, while WordPress puts that responsibility on you or your developer. A well-maintained WordPress site is very secure; a neglected one isn't. Compare the two in our guide to WordPress vs Shopify.
How often should I update plugins?
Check at least weekly, and install security updates as soon as possible. Many sites use automatic updates for minor releases with regular manual checks.
Should I consider Cyber Essentials?
Cyber Essentials is a UK government-backed scheme covering basic security controls across your business. It's worth considering, and it's required for some public sector contracts.
The bottom line
Work through this WordPress security checklist and keep it going: update everything, lock down logins with two-factor authentication, back up automatically off-site, use secure hosting and monitor for problems. Security is ongoing maintenance, and it's far cheaper than recovering from a hack.