QUAKE MEDIA / THE PRACTICAL GUIDE
WordPress security: a practical maintenance and recovery plan
Protect a WordPress website with clear ownership, maintained software, controlled access, recoverable backups and tested security changes.
Explore the guideBy Quake Media · 4 minute read
Protection includes a way back.
A framework for the decisions in this guide.
Access / EXPLORE THE DETAILS
The starting point
Website security needs an owner, a maintenance routine and a recovery plan. Start with the systems your business depends on: domain registration, DNS, hosting, WordPress, email and connected services. A plugin cannot take responsibility for all of them.
Maintenance / EXPLORE THE DETAILS
Record who controls each account
Keep a private inventory of account owners, administrative contacts and recovery methods. Use business-controlled accounts for the domain, hosting and important integrations. Give people access appropriate to their role and remove access when the relationship ends.
Use unique credentials and multi-factor authentication where supported. Test the recovery process before an emergency, and store recovery material securely. Do not share a single administrator login among everyone working on the site: individual accounts make access changes and investigations easier.
Recovery / EXPLORE THE DETAILS
Protect the domain and DNS
Confirm the registrar account, renewal method and contact address are current. Review who can change DNS records, which nameservers are authoritative and how a mistaken change would be reversed. Save a copy of the working DNS configuration in the private operational record.
Before changing email-related DNS records, identify every system that sends mail for the business. Before changing web records, confirm the intended destination and launch plan. Domain access can affect the website and email together, so treat it as a critical business account.
Access / EXPLORE THE DETAILS
Maintain the software you actually use
Inventory WordPress core, themes, plugins and custom code. Record why each component is installed and who maintains it. Remove unused components through a controlled change after confirming dependencies. Obtain software from sources you can verify.
Plan updates with a backup and tests for the site's important functions. The WordPress hardening handbook covers updates, trusted software, access and server considerations. Coordinate hosting and runtime maintenance with the provider rather than assuming a WordPress update covers the whole server.
Maintenance / EXPLORE THE DETAILS
Make backups useful in a real recovery
- Check that scheduled backups actually complete.
- Restore a representative backup into an isolated environment.
- Verify pages, media, accounts and business functions.
- Record the time required and any missing information.
- Assign the person who can authorize and perform a recovery.
Identify what must be restored together: database, uploaded media, custom code and configuration. Choose backup frequency around the amount of new content or transaction data the business can tolerate losing. Keep backups protected from public access and from the same failure that could affect the live site.
A backup file existing on disk is not proof that the site can be restored. Test the process and keep instructions accessible to the people responsible for recovery.
Recovery / EXPLORE THE DETAILS
Test security changes against real workflows
Review permissions, HTTPS, caching and server configuration in the context of the actual application. Do not paste a long list of disabled functions or firewall rules into production without understanding the dependencies. Blocking an interface may interrupt editing, payments, forms or a connected system.
| Change | Verification |
|---|---|
| Account or role restrictions | Authorized tasks work; unrelated records and administrative operations remain unavailable |
| Firewall or request limits | Legitimate forms, checkout and integrations still work under expected usage |
| Caching or proxy rules | Private responses are not served to other visitors |
| Server or software update | Pages, uploads, email and scheduled tasks pass the agreed checks |
| Credential revocation | The old credential fails and the replacement integration works |
Use the REST API security guide for endpoint-specific access checks. Public content and private operations require different treatment; hiding a URL is not an authorization design.
Access / EXPLORE THE DETAILS
Monitor problems someone will investigate
Decide which failures require action: unexpected administrator changes, repeated authentication failures, altered files, unavailable pages or missing enquiry notifications. Route alerts to a monitored channel with a named owner. Review noise so important events do not disappear among routine notifications.
Keep logs protected and limit recorded data to what is needed for diagnosis. Avoid storing passwords, tokens and unnecessary customer content. Record normal deployment activity too, so a legitimate release is distinguishable from an unexplained change.
Maintenance / EXPLORE THE DETAILS
Prepare for an incident before it happens
Document who can contact the host, restrict access, preserve relevant evidence, restore service and communicate with affected stakeholders. If compromise is suspected, investigate the entry point and affected systems; restoring an old backup without correcting the cause may leave the same problem in place.
Keep a timeline of observations and changes. Coordinate credential replacement across the systems involved and verify the recovered site's business functions. Ask an appropriate specialist to assess obligations and next steps when sensitive information may be involved.
Recovery / EXPLORE THE DETAILS
A manageable review routine
- Check failed backups, urgent updates and actionable alerts.
- Review access when staff or suppliers change.
- Test important workflows after releases.
- Periodically rehearse restoration and update the account inventory.
- Revisit the plan when adding payments, accounts, integrations or a new hosting provider.
For an upcoming rebuild, use our migration checklist to include credentials, dependencies and recovery arrangements in the handoff. Contact Quake Media to discuss website maintenance and development scope.
Access / EXPLORE THE DETAILS
Put this guide to work
Clarify hosting responsibilities, backups and support as part of the maintenance plan. Explore our website hosting, or tell us about your project to discuss the next step.
FROM READING TO DOING
Make your next
move a clear one.
Bring us your goals and the questions this guide raised. We’ll help you work out what belongs in your plan.
Talk it through with Quake