Security Best Practices & Database Backups

The basics: updates, passwords, and login limits

Most WordPress hacks exploit outdated software — an old plugin, theme, or WordPress core version with a known vulnerability. Enable auto-updates where possible, and check Dashboard → Updates regularly.

Use strong, unique passwords for every account, and install a login-limiting plugin (or your host's built-in protection) to block repeated failed login attempts, which stops brute-force attacks.

Real-life example: An outdated plugin is like leaving a spare key under the doormat that everyone in the neighborhood already knows about — updates change the lock before someone finds it.

Hardening checklist

Beyond updates and passwords, a handful of extra steps meaningfully reduce risk without needing deep technical skill.

• Rename the default “admin” username if you still use it
• Enable two-factor authentication (2FA) for all Administrator accounts
• Install an SSL certificate (https) — many hosts offer this free
• Use a security plugin (Wordfence, Sucuri) for firewall and malware scanning
• Hide your WordPress version number from public view
• Restrict file editing from the dashboard (Appearance/Plugin editor) on production sites

<?php
// Prevents editing theme/plugin files directly from wp-admin
define( 'DISALLOW_FILE_EDIT', true );

Database and file backups

A backup should cover two things: your database (posts, settings, comments — stored in MySQL) and your files (themes, plugins, uploads, in wp-content/). Losing either one means an incomplete restore.

Use a backup plugin (UpdraftPlus, BlogVault) to schedule automatic backups to an external location like Google Drive, Dropbox, or Amazon S3 — never rely only on backups stored on the same server.

# Export (backup) the database
mysqldump -u wp_user -p wordpress_db > backup-2026-07-28.sql

# Restore from a backup file
mysql -u wp_user -p wordpress_db < backup-2026-07-28.sql