Most WordPress sites are not hacked by someone targeting your business. They are found by automated scanners looking for known vulnerabilities in specific plugin versions. That is good news: it means keeping things current stops nearly all of it.

The routine

Frequency	Task
Weekly	Check for updates, apply security ones immediately
Weekly	Confirm the site loads and the contact form delivers
Monthly	Test-restore a backup, review admin users
Monthly	Delete unused plugins and themes
Quarterly	Review PHP version, check for abandoned plugins
Always	Backup before any major update

Updates, done safely

Enable automatic updates for minor WordPress releases, which are almost always security fixes and rarely break anything.

For plugin and theme updates, take a backup first, then update in small batches rather than all at once, so you know what broke if something does.

Afterwards, check the pages that matter: the homepage, a service page, the contact form, and any checkout. Form delivery and payment flows are the two things that break silently, and nobody notices until an enquiry is lost.

If you cannot risk breaking the live site, use a staging copy. Many South African managed hosts include one.

Plugins are the risk surface

Every plugin is code someone else wrote running on your site. Fewer is safer.

Delete what you do not use. Deactivating is not enough; an inactive plugin still sits on the server and can still be exploited.

Check plugins are maintained. On the plugin page, look at when it was last updated. Anything untouched for over a year is a growing liability regardless of how well it works today.

Avoid nulled or pirated plugins entirely. They are one of the most reliable ways to install malware deliberately.

Prefer well-used plugins with large install counts and active support, because vulnerabilities in those get found and patched quickly.

Logins

Never use "admin" as a username. Use strong unique passwords, and turn on two-factor authentication for every administrator account.

Give people the lowest role that lets them do their job. Someone who writes blog posts is an Editor, not an Administrator.

Limit login attempts so brute-force attempts are throttled, and review your user list monthly. An administrator account you do not recognise is the clearest sign of a compromise.

Backups that actually work

The requirements are simple and frequently unmet: automated, off-site, and tested.

Off-site matters. Backups stored on the same server are lost with the server, and a compromised server usually means compromised backups.

Tested matters more. A backup you have never restored is a hypothesis. Restore one to a staging site once a quarter and confirm it works.

Daily backups for an active site or store, weekly for a brochure site, and keep at least 30 days of history, because malware is often present for weeks before anyone notices.

The rest of the basics

HTTPS across the whole site, which browsers now require in practice. A security plugin or host-level firewall for login protection and malware scanning, but only one, because several conflict and slow the site. A current PHP version, since old versions stop receiving security patches. And no file editing from the WordPress admin, which is a setting worth turning off.

If you are hacked

Take the site into maintenance mode or offline so visitors are not exposed.

Restore the most recent backup you are confident predates the compromise. Then update WordPress, every theme and every plugin, change every password including hosting and database, and check for administrator users and scheduled tasks you did not create.

Then find out how they got in. Restoring without closing the entry point simply means it happens again, usually within days.

If customer data was involved, POPIA requires you to notify the Information Regulator and affected people.

Juicy Designs handles updates, backups and monitoring under website maintenance and managed hosting. Related: website security and legal requirements and speeding up WordPress.

Frequently asked questions

How do I keep my WordPress site secure?

Update WordPress, themes and plugins regularly, use strong unique passwords with two-factor authentication on admin accounts, keep automated off-site backups, delete plugins you do not use, and put a security plugin or firewall in front of the login page.

How often should I run updates?

Check weekly and apply security updates immediately. Take a backup before major updates and test the site afterwards, particularly the contact form and any payment process.

What is the most common way WordPress sites get hacked?

Outdated plugins, by a wide margin. Attackers scan for known vulnerabilities in specific plugin versions, so an unpatched plugin is found automatically rather than targeted.

Do I need a security plugin?

One is useful for login protection, firewall rules and malware scanning. Do not install several, because they conflict with each other and slow the site down.

What do I do if my site is hacked?

Take it offline or into maintenance mode, restore the most recent clean backup, update everything, change every password, and check for admin users you did not create. Then work out how they got in, or it happens again.