WordPress Website Security: A Practical Approach to Keeping Your Website Protected

Website security can sound scary. We often hear on the news about hacked websites, stolen passwords, malware, and data breaches. But keeping a WordPress website safe does not need to be based on fear.

In most cases, good website security comes down to regular maintenance. Keep the website updated. Limit who has access. Know what information the website stores. And make sure someone is checking the site on a regular basis.

At designRoom, we help maintain and support WordPress websites for many of our behavioral health clients. Every website is different, but there are several things we look at to help keep a site safe and running well.

1. Know What Personal Information Your Website Stores

One of the first questions we ask is: What information is this website saving?

Contact forms made with tools like Gravity Forms and Ninja Forms may save form entries inside WordPress. Even a basic contact form may collect a person's name, email address, and phone number. Some forms may collect much more personal information. This can be especially important for healthcare, behavioral health, and human service organizations. A person may write about an illness, diagnosis, treatment, or other private information in a form.

That information should not stay on the website forever if there is no reason to keep it there. For many websites, designRoom recommends keeping form entries for about 30 to 60 days, depending on the organization's needs and policies. After that time, old entries can be removed from WordPress. If the organization needs to keep those records, they can be moved to a more secure system that the organization controls.

The basic idea is simple:

Do not keep personal information on your website longer than you need it.

2. Keep WordPress, Themes, and Plugins Updated

A WordPress website has several parts that need regular updates.

These include:

• WordPress itself
• The website's theme
• Plugins

Updates often fix bugs and security problems. They can also help the different parts of the website continue working well together. But keeping a website updated does not mean installing every plugin you find. It is also important to look at who created the plugin and whether it is still being supported.

Before adding a plugin, we look at things like reviews, recent updates, the company or developer behind it, and whether the plugin has a good reputation. Poorly made or unsafe plugins can create security problems of their own. That is one reason we prefer to keep WordPress websites as lean as possible. If a website does not need a plugin, it may be better not to install it. Fewer plugins can mean fewer things to update, monitor, and protect.

3. Limit the Number of WordPress Administrators

One of the most important things we look at is who has Administrator access to the website.

A WordPress Administrator can make major changes to a website. An Administrator may be able to install plugins, change settings, add users, delete users, and make other important changes. Not everyone needs that level of access.

At designRoom, we prefer to keep the number of Administrators small. For many websites, that means around three to six trusted people. Someone who only needs to write a blog post or update a page may only need an Editor or Author account. Administrator access should normally be limited to people who understand how WordPress works, such as a website developer, an IT professional, or a trained staff member.

We also recommend that a person's WordPress username be different from the name shown publicly on the website. For example, if an author's name appears on blog posts, their login username should not simply be that same name. A username is not as private as a password, but using a less predictable username adds another level of protection. Every Administrator should also have a strong and unique password that is not being used anywhere else. And when an employee, developer, or outside partner no longer needs access, their account should be removed.

4. Use Two-Factor Authentication

A strong password is important, but adding another layer of protection is even better. That is where two-factor authentication, or 2FA, can help. With 2FA turned on, a person signs in with a username and password and then completes one more step. For example, they may need to enter a temporary code from an authentication app on their phone. This can help protect an account even if someone else learns the password. For that reason, we strongly recommend using 2FA for WordPress Administrator accounts.

5. Use a Firewall and Regular Security Scans

For many of the WordPress websites we manage, Wordfence is our preferred security plugin. Wordfence can help watch for problems on a WordPress website. It includes tools for:

• Firewall protection
• Malware scanning
• Login security
• Two-factor authentication
• Vulnerability alerts
• Suspicious file changes

A good hosting company should also provide server-level security. This creates more than one layer of protection. The hosting company helps protect the server and hosting account, while tools like Wordfence help monitor activity within WordPress. We believe this layered approach is better than relying on one single tool to protect the entire website.

6. Keep Regular Website Backups

Website security is not only about stopping something bad from happening. It is also about being ready if something does happen. A WordPress website should have regular backups. A backup gives you a saved version of the website that may be used if something goes wrong. For example, a backup may help if:

• An update breaks the website
• Important files are damaged
• Someone deletes something by mistake
• The website is hacked
• Malware changes website files

Many good hosting companies create automatic backups. But it is still important to know how often backups are made, where they are stored, and how the website can be restored. Someone should also know who is responsible for restoring the website if there is ever a problem. Having backups is good. Knowing how to use them is even better.

7. Review Website Users and Access

Website access can change over time. Employees leave. Vendors change. Developers finish projects. Staff members move into different roles. As a result, WordPress users should be reviewed periodically. Look for accounts that are no longer needed. Also check whether each person still needs the level of access they have. Someone who needed Administrator access during a website project may not need that same access six months later. Removing old accounts and reducing unnecessary Administrator access can help lower the risk of someone getting into the website.

8. Make Website Security Part of Regular Maintenance

The most important part of WordPress security may simply be consistency. A website should not be launched and then ignored for years. Someone should be checking it regularly. That may be someone inside the organization, the hosting company, the developer, or a combination of all three. Regular website maintenance should include checking:

• WordPress, plugin, and theme updates
• Security warnings and known vulnerabilities
• Administrator and user accounts
• Stored form submissions
• Website backups
• Firewall and malware scans
• Hosting and server software
• Plugins that are no longer being used

None of these steps should cause additional stress. They simply need to be someone's responsibility.

Good WordPress Security Is Good Website Maintenance

There is no single plugin or tool that can promise a website will never have a security problem. Good security comes from using several layers of protection. Keep WordPress updated. Use trusted plugins. Limit Administrator access. Use strong passwords and 2FA. Remove personal information that does not need to be stored. Keep backups. And have someone regularly check the website. For organizations without staff to handle these tasks, a trusted developer and hosting company can help. At designRoom, maintaining a behavioral health website means more than ensuring the pages work. It also means looking behind the scenes, watching for possible problems, and taking reasonable steps to help keep the website and its users safe. Website security does not need to be frightening.

It just needs someone to keep an eye on it.

designRoom works with behavioral health, mental health, addiction treatment centers, healthcare, and other nonprofit organizations to build brands, websites, content, and marketing strategies positioned for growth to help you connect with the people you need to reach.

Contact us today to schedule a risk-free 15-minute assessment to learn more about the health of your website.