Most hacked business websites weren’t hacked by geniuses. They were left open. An old plugin, a reused password, a forgotten admin account. Attackers run automated tools that try thousands of sites a day, looking for exactly that.
Here’s what to ask your developer or agency, and what to check yourself.
Who has admin access? Log in and look at the user list. Every account should belong to someone you can name. Delete the rest.
When were plugins and themes last updated? Outdated plugins are the most common way into WordPress sites. If the answer is “a while ago”, that’s your first job.
Are there plugins nobody uses? Every inactive plugin is code sitting on your server. If you don’t need it, delete it.
Is two step login switched on? For your website, your hosting account and your email. A stolen password alone shouldn’t be enough to get in.
Where are the backups, and has anyone tested restoring one? A backup you’ve never restored is a hope, not a plan.
Does anyone check the server for strange files? Hackers often leave hidden files that let them come back. Your site can look perfectly normal while one sits there for weeks.
If you host several sites on one account, remember that one weak site puts the others at risk. Clean up the ones you don’t use.
