A new WordPress install is easiest to secure before it accumulates plugins, users, and custom code. Start with access control, updates, and backups.
Use Strong Admin Details
Use a unique admin username, a strong password, and two-factor authentication where available.
Create named accounts for each administrator instead of sharing one login. Give editors or shop staff only the role needed for their work. Protect the email address used for password recovery with its own strong password and two-factor authentication, otherwise an attacker can bypass a well-protected WordPress login.
Remove What You Do Not Need
Delete unused themes, plugins, demo content, and test users. Less code means less to maintain.
Keep one maintained fallback theme if you need it for troubleshooting, but remove abandoned extensions rather than merely deactivating them. Check that sample pages, comments and installation files do not disclose information you did not intend to publish.
Set Updates Deliberately
Keep WordPress current, but test major plugin and theme changes on staging where possible.
Enable timely security updates, subscribe to notices for important commercial plugins and decide who checks the site after updates. Do not run unsupported PHP simply because an old plugin requires it; replace the dependency or plan a controlled upgrade.
Configure Backups
Take a baseline backup after setup and before launching. Know how to restore it.
A useful backup includes both files and the database, is stored away from the live account and has a retention period appropriate to the site. Perform a test restore to a staging location before depending on it. Record who can request a restore and how long recovery is expected to take.
Harden the Hosting Layer
Force HTTPS, use a current PHP version and leave file editing restricted to people who need it. Do not set files or directories to world-writable permissions to solve an upload error. Use SFTP or SSH instead of plain FTP and keep database credentials out of public repositories.
Control Forms and Login Attempts
Add proportionate login protection and spam controls without blocking genuine customers. Rate limiting, two-factor authentication and a reputable form anti-spam service are more useful than hiding the login URL alone. Test password resets and form delivery after enabling security rules.
Establish a Review Routine
Check administrators, plugins, themes, backups and security logs regularly. Remove access when a supplier leaves and investigate unexpected file changes or new users promptly. Security is a maintained process; a plugin installed on launch day cannot replace routine review.
Security is easier when the site starts clean.
