Protecting your WordPress website

The protections we provide, and the ones only you can put in place.

Security works as a series of layers, each one closing off a route an attacker might take. We provide the layers underneath your site. The rest sits with whoever runs it.

Use strong passwords

No amount of hardening compensates for a weak password, so this is the single most effective thing you can do. See choosing a strong password for what that means in practice.

Lock the file system when you are not working on the site

Lockdown mode makes every file and directory unwritable by the web server. That stops an attacker writing to your site even if they find a way in. Open the Pendeo menu in your WordPress admin, choose Security Lockdown, then click Lockdown.

Turn it off again when you next need to install or update something, and turn it back on afterwards.

Keep everything updated

Most compromises use a known flaw in an out-of-date plugin or theme. Applying updates promptly closes them, and you can restore a snapshot from the Pendeo plugin if an update goes wrong.

Checking and cleaning

Several third-party services scan a site from the outside and report what they find. Sucuri SiteCheck is free and quick. Sucuri's firewall filters traffic before it reaches your site, and the same company cleans compromised sites.

The OWASP Foundation publishes the reference material behind most web security advice, if you want to understand the underlying risks.