Most security incidents I get called in to clean up were not clever attacks. They were an outdated plugin, a shared password, or a backup nobody had ever tested. If you are an operations or marketing leader who owns the outcome of your website but not the code, WordPress security for business websites is mostly a question of whether your agency is doing a short list of unglamorous things consistently.

Here is what I expect to be handled on every site I manage through my web development services, and what I would ask any agency to show you.

Updates are scheduled, tested and documented

WordPress core, themes and plugins all release security fixes. Leaving them for months is the most common way sites get compromised. But blindly clicking “update all” on a live store is how checkouts break.

The right process is to update on a regular schedule, test changes on a staging copy for anything revenue-critical, and keep a record of what changed and when. That matters most for WooCommerce stores, where a bad update can interrupt orders. Ask your agency how often updates run and whether you can see the log.

Backups exist off the server and have been restored at least once

A backup stored on the same server as the site is not much protection if that server fails or is compromised. Backups should be automated, stored somewhere separate, and kept for enough days to reach back before a problem started.

The part people skip is the restore test. A backup you have never restored is a hope, not a plan. Ask when the last test restore was performed and how long recovery would take.

Access is limited and reviewed

Over the years, sites collect administrator accounts: former employees, past freelancers, old agencies. Each one is a door. Your site should have named accounts for each person, the minimum role each needs, two-factor authentication for anyone with administrator access, and a periodic review that removes people who no longer need in.

Shared logins are a red flag. If something goes wrong, you cannot tell who did what.

Plugins are chosen and pruned deliberately

Every plugin adds code you depend on. I look at whether a plugin is actively maintained, how recently it was updated, and whether the site really needs it. Abandoned plugins and unused ones get removed, not just deactivated. A leaner site is easier to secure and usually faster too.

Hosting and the basics underneath the site

Security does not stop at WordPress. A current PHP version, a valid SSL certificate, sensible server-level protections and a host that responds when something goes wrong all matter. Your agency should know what your hosting environment provides and where the gaps are, rather than assuming the host covers everything. This is the reason I offer managed hosting alongside development, so one team owns both layers.

Monitoring and an incident plan

Someone should be watching for downtime, file changes and failed login patterns, and should know in advance what happens if the site is compromised: who is called, how the site is isolated, how it is restored, and who tells your customers if data is involved. Deciding that during an incident is too late.

Questions to ask your agency

• How often do you update core, themes and plugins, and where do you test first?
• Where are backups stored, how long are they kept, and when did you last restore one?
• Who currently has administrator access to our site, and is two-factor enabled?
• What is our incident response plan if the site is compromised?

If an agency answers these quickly and specifically, that tells you a lot. If the answers are vague, that tells you more.

Security is not a one-time project. It is a routine, and the value is in the routine being done and visible to you. If you would like a second set of eyes on how your current site is being maintained, request a consultation and I will walk through it with you.