WordPress runs 43%+ of the web in 2026, which makes it a constant target for automated attacks. Most attacks are stoppable with basic hygiene. Most agencies don’t do basic hygiene. Here’s the actual checklist.
What actually matters
- Keep WordPress core updated. Within 72 hours of a security release. Outdated core is the #1 vulnerability vector.
- Keep plugins updated. But test on staging first. Bad plugin updates have broken more sites than security issues have.
- Strong passwords + 2FA on admin accounts. The single most effective single defense. Free, takes 2 minutes.
- Limit login attempts. Plugin like Limit Login Attempts Reloaded stops brute force in its tracks.
- Disable file editing in WP admin. Add
define('DISALLOW_FILE_EDIT', true);to wp-config.php. Prevents code injection if admin accounts get compromised. - HTTPS everywhere. SSL certificate active, no mixed content, HSTS header. Cheap (free with Let’s Encrypt), high impact.
- Daily off-site backups. If everything else fails, backups save you.
What doesn’t matter as much as people say
- Hiding the WP admin URL. Security by obscurity. Doesn’t actually stop attackers, just slightly inconveniences them.
- Removing the WP version number from the header. Same — doesn’t stop attacks, just makes them slightly less efficient.
- Generic ‘security plugins’ running 50 features. Many overlap with what good hosting already does. Some slow your site down without adding meaningful protection.
Quebec-specific considerations
If your business handles customer data (forms, e-commerce, accounts), Quebec privacy law (Law 25) is now in effect. You’re required to:
- Have a privacy policy that explains data collection
- Have a data protection officer (or designate one)
- Report data breaches within reasonable time
- Allow customers to request their data
Law 25 doesn’t directly require specific security measures, but data breaches now have legal consequences. The security checklist above also reduces your Law 25 liability.
Real-world incident frequency
Based on what we see across the sites we maintain: well-configured WordPress sites have ~1 security incident per 5 years. Poorly-configured WordPress sites have ~1 incident per year. The gap is entirely about whether the basics above are done.
If your site is currently insecure
The fix is straightforward but takes ~4-8 hours of work depending on site complexity. We do this as part of our Maintenance plans — typically the first month’s work for new clients is security hardening before anything else.