{"id":36,"date":"2026-07-18T10:26:27","date_gmt":"2026-07-18T10:26:27","guid":{"rendered":"https:\/\/demos.canvaswp.com\/hosting\/2026\/07\/18\/hardening-a-wordpress-site-that-is-already-live\/"},"modified":"2026-07-18T10:26:27","modified_gmt":"2026-07-18T10:26:27","slug":"hardening-a-wordpress-site-that-is-already-live","status":"publish","type":"post","link":"https:\/\/demos.canvaswp.com\/hosting\/2026\/07\/18\/hardening-a-wordpress-site-that-is-already-live\/","title":{"rendered":"Hardening a WordPress site that is already live"},"content":{"rendered":"<p class=\"lead\">You do not need a security plugin so much as a short list of habits. These are the ones that actually correlate with sites that never get compromised.<\/p><h3 class=\"ls-0\">Update, or accept the consequence<\/h3><p>Almost every compromise we clean up came in through a known vulnerability in an out-of-date plugin, months after a fix shipped. Turn on automatic updates for minor releases and review the majors monthly.<\/p><h3 class=\"ls-0\">Reduce the surface<\/h3><p>Deactivating a plugin does not make it safe; the files are still on disk and still reachable. Delete what you do not use, and remove themes you are not running.<\/p><h3 class=\"ls-0\">Make the admin harder to reach<\/h3><p>Two-factor on every account with write access, and no shared logins: team accounts exist so that each person has their own and you can revoke one without changing anything else.<\/p><ul class=\"iconlist iconlist-color ms-0\"><li>Enforce two-factor for the whole team<\/li><li>Give editors editor accounts, not administrator accounts<\/li><li>Disable file editing from the dashboard<\/li><li>Rotate any credential that has ever been in a chat message<\/li><\/ul><h3 class=\"ls-0\">Assume it will happen anyway<\/h3><p>Backups are the only control that works after the fact. Ours are daily and kept for thirty days, restores are self-service, and it is worth doing one deliberately now so that you already know how it works when it matters.<\/p>","protected":false},"excerpt":{"rendered":"<p>Not a plugin so much as a short list of habits: the ones that actually correlate with sites that never get compromised.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[28,11,29],"class_list":["post-36","post","type-post","status-publish","format-standard","hentry","category-security-ssl","tag-backups","tag-security","tag-wordpress"],"_links":{"self":[{"href":"https:\/\/demos.canvaswp.com\/hosting\/wp-json\/wp\/v2\/posts\/36","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/demos.canvaswp.com\/hosting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/demos.canvaswp.com\/hosting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/demos.canvaswp.com\/hosting\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/demos.canvaswp.com\/hosting\/wp-json\/wp\/v2\/comments?post=36"}],"version-history":[{"count":0,"href":"https:\/\/demos.canvaswp.com\/hosting\/wp-json\/wp\/v2\/posts\/36\/revisions"}],"wp:attachment":[{"href":"https:\/\/demos.canvaswp.com\/hosting\/wp-json\/wp\/v2\/media?parent=36"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/demos.canvaswp.com\/hosting\/wp-json\/wp\/v2\/categories?post=36"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/demos.canvaswp.com\/hosting\/wp-json\/wp\/v2\/tags?post=36"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}