WordPress hardening for sites that actually drive revenue
WordPress is not insecure by default; the typical agency install is. A concrete checklist for PR businesses that depend on the site for leads.
WordPress powers most corporate sites in Puerto Rico — law firms, clinics, restaurants, contractors. When Smashing Magazine publishes performance guides, local shared hosting rarely applies the same rigor to security. The result: exposed wp-admin, open xmlrpc, and twenty "free" plugins not updated since 2021.
The OWASP Top 10 remains relevant: injection in poorly sanit
The OWASP Top 10 remains relevant: injection in poorly sanitized contact forms, booking plugins with SQL issues, and file uploads without validation. You do not need PHP expertise to shrink attack surface: disable the file editor in wp-config, rate-limit login attempts, and use an admin username that is not "admin".
Updates: yes, they break poorly built themes
Updates: yes, they break poorly built themes. That is why we recommend staging on a subdomain before touching production — even for small SMBs, a weekly host snapshot is enough. Remove inactive themes and plugins; each is code nobody reviews but still executes.
For lead-capture businesses: connect forms to a CRM with rotating tokens, never leave SMTP credentials in the theme repo, and put Cloudflare or similar in front with basic WAF rules. Google Security Blog has documented malware campaigns in nulled plugins; saving $49 on a premium license does not offset ransomware.
If your site is your main sales channel, treat it as product, not brochure. File integrity monitoring, off-site backups, and MFA on hosting accounts are the 2023 minimum — and still the minimum today.
Writes about practical cybersecurity for SMBs in Puerto Rico and the Caribbean — no fluff, just what actually needs to get done.
