WordPress powers a very large share of the world's websites. It's an excellent platform, but an unmaintained WordPress site becomes slow and vulnerable. Here are 10 simple checks you can do, even if you're not technical.
1. Is everything up to date?
In the dashboard, go to Dashboard → Updates. WordPress, your theme and plugins receive regular security fixes. A plugin that hasn't been updated for months is one of the most common ways in for attackers. Back up first, then update.
2. Do you have unused plugins?
Every plugin adds code, which means more risk and more weight. Delete (not just deactivate) the ones you no longer use, and avoid plugins abandoned by their authors or downloaded from unofficial sites.
3. Who has an administrator account?
Check the list under Users. Remove former providers and unknown accounts. Everyone should have their own account with the lowest role that works (Editor rather than Administrator where possible).
4. Are passwords strong?
Use long, unique passwords, ideally kept in a password manager, and turn on two-factor authentication for administrators. Avoid the username "admin".
5. Do you have a recent, tested backup?
A backup must include files and the database, be stored outside your hosting, and have been restored at least once to prove it works. An untested backup is just a hope.
6. Is HTTPS everywhere?
The SSL certificate must be valid and every page must open with https://. An expired certificate shows a warning that scares visitors away and hurts your SEO.
7. Which PHP version does your hosting use?
WordPress runs on PHP, the server language. Old versions no longer get security fixes and are slower. Your host usually lets you change version in its control panel: do it after a backup, then test the site.
8. Is your site slow on mobile?
Test it with Google's PageSpeed Insights. The usual causes: oversized images, too many plugins, a heavy theme, weak hosting, no caching. Compress images before uploading them.
9. Is Google flagging a problem?
Add your site to Google Search Console (free). The "Security issues" report warns you if Google detects a hack, and the indexing report shows which pages Google actually sees.
10. Can you recognise the signs of a hack?
- The site redirects to gambling, pharmacy or other dubious sites;
- Unknown pages appear in Google results (often in a foreign language);
- A new administrator you didn't create;
- Your host suspends the site or reports spam being sent;
- The browser shows a "dangerous site" warning.
Has your site been hacked? Don't panic and don't delete things at random. Change all passwords (WordPress, hosting, database, FTP), tell your host, then have the site cleaned by someone competent: the vulnerability must be found and closed, or the hack will come back.
In short
Updates, clearing out plugins and accounts, tested backups, HTTPS, a current PHP version and Search Console: these simple steps prevent the vast majority of problems. Rather not think about it? That's exactly what our FusionTech Care WordPress maintenance is for. And to find out where your site stands, request our free audit.