27 must do's to keep your WordPress site cyber secure

WordPress is one of the most widely used website platforms in the world. However, like other PHP-based content management systems, it can be vulnerable to cyberattacks if it is not properly configured, maintained, monitored, and secured.

WordPress faces a reported 4.7 million hacks per year, with many of these attacks originating from vulnerabilities in third-party plugins used by website providers to build and operate websites.

Furthermore, 88% of these plugins are reported to be non-commercial-grade, cyber-secure plugins, raising serious concerns about the quality, maintenance, security standards, and accountability of third-party software used in WordPress websites.

These risks are particularly important because WordPress websites frequently depend on multiple independent plugin developers, hosting companies, and service providers, each introducing potential cybersecurity vulnerabilities.

The cybersecurity of a WordPress website therefore depends not only on WordPress itself but also on the quality of its plugins, hosting infrastructure, access controls, security monitoring, and the competence and accountability of the website provider.

Any recruiter commissioning or operating a WordPress website should require its website provider to meet the following 27 cybersecurity standards. Recruitment websites need to be secure, or recruiters face acute risk.

1. Plugin Management and Security

1. Complete plugin inventory

The website provider must supply a complete list of every plugin used to build and operate the website, including its purpose, developer, and whether it is free, commercially licensed, or custom-developed.

2. Plugin version and security update records

The provider must record the version of every plugin, the date it was last updated, the latest available version, and whether any known security vulnerabilities remain unresolved.

3. Direct access to plugin developers

The provider must maintain a direct communication and support route to plugin developers or maintainers so that security vulnerabilities, code updates, and compatibility issues can be addressed promptly.

4. WordPress and plugin update reporting

The provider must issue a monthly report confirming the status of WordPress core updates, plugin updates, theme updates, and compatibility checks, including any outstanding updates and associated security risks.

5. Automatic updates are not sufficient protection

The provider must not rely solely on WordPress automatic updates as its cybersecurity strategy. Automatic updates should be supported by active vulnerability monitoring, testing, security verification, and a documented remediation process.

Any website provider relying exclusively on WordPress automatic updates should not be considered to have a comprehensive cybersecurity management strategy.

6. Plugin data storage and access assessment

Every plugin must be assessed to establish what information it collects, stores, processes, or transmits, including personal data, customer records, login credentials, and commercially sensitive information.

7. Specialist WordPress cybersecurity protection

The provider must deploy appropriate additional security services, such as specialist WordPress security monitoring, vulnerability scanning, malware detection, and firewall protection from reputable cybersecurity suppliers.

2. Hosting and Infrastructure Security

8. Secure, professionally managed hosting

The website must operate on a professionally managed hosting environment with appropriate server security, isolation, monitoring, access controls, and protection against unauthorised access.

9. Web Application Firewall (WAF)

A properly configured Web Application Firewall must protect the website against common attack methods, including malicious bots, SQL injection, cross-site scripting, and exploitation of known vulnerabilities.

10. Multi-Factor Authentication (MFA)

All website administrators, developers, suppliers, and other users with privileged access must use Multi-Factor Authentication.

Password-only access must not be considered sufficient for privileged accounts.

11. Continuous vulnerability monitoring

The provider must continuously monitor WordPress, plugins, themes, PHP, and relevant server components for newly disclosed cybersecurity vulnerabilities.

Security monitoring must not be limited to monthly maintenance checks.

12. Mandatory security patching deadlines

The provider must operate a documented security patching policy with defined response times.

Critical vulnerabilities must be assessed immediately and remediated or mitigated urgently, targeting 24 hours where practicable.

High-risk vulnerabilities must also have defined remediation deadlines, with documented exceptions and compensating controls where necessary.

3. Backups, Recovery and Business Continuity

13. Independent automated backups

The provider must perform automated daily backups of website files, databases, and essential configurations, with more frequent backups where the nature of the website requires them.

Backups must be securely stored separately from the live hosting environment and protected against unauthorised deletion or modification.

14. Tested disaster recovery procedures

The provider must maintain a documented disaster recovery plan and regularly test the restoration of the website.

The service agreement must define the Recovery Time Objective (RTO) and Recovery Point Objective (RPO), establishing how quickly the website must be restored and the maximum acceptable data loss.

4. Independent Security Testing and Access Management

15. Independent penetration testing

The website must undergo independent cybersecurity penetration testing at least annually and following significant technical changes.

The provider must supply evidence of testing, identify material vulnerabilities, and demonstrate that serious security issues have been addressed.

16. Removal of unnecessary software

Unused, obsolete, unsupported, or abandoned plugins, themes, software components, and user accounts must be removed to reduce the potential attack surface.

17. Restricted administrative access

The provider must implement role-based access controls and the principle of least privilege.

Users, developers, and third-party suppliers must receive only the permissions required to perform their duties.

Privileged access must be reviewed regularly and revoked when no longer required.

18. Real-time malware and website integrity monitoring

The provider must monitor for malicious code, unauthorised file modifications, suspicious logins, unexpected administrator accounts, and other indicators of compromise.

Security alerts must be reviewed and investigated by a designated responsible party.

5. Incident Response and Supplier Accountability

19. Documented cybersecurity incident response plan

The provider must maintain a documented incident response plan explaining how suspected or confirmed security breaches will be identified, investigated, contained, and resolved.

The plan must specify customer notification procedures, escalation responsibilities, and the arrangements for restoring services.

20. Contractual cybersecurity responsibility

The provider must accept clearly defined contractual responsibility for the security services it supplies, including maintenance, patching, monitoring, vulnerability management, and incident response.

These responsibilities must be documented in the service-level agreement, including response times, reporting obligations, escalation arrangements, and any agreed remediation liabilities.

21. Data protection and UK GDPR compliance

The provider must demonstrate appropriate compliance with UK GDPR and applicable data protection legislation.

This includes documenting what personal information is collected, where it is stored, who can access it, how it is protected, and whether third-party plugins or services transfer data to other organisations or jurisdictions.

6. Software Quality and Change Control

22. Prohibition of unsupported or insecure plugins

Plugins must not be deployed where they are abandoned, unsupported, obtained from untrusted sources, or contain unresolved serious security vulnerabilities without appropriate risk assessment and mitigation.

Commercially supported plugins should be considered where appropriate, but paid licensing alone must not be treated as proof of cybersecurity quality.

23. Secure staging and update testing

The provider must maintain an appropriate staging or testing environment for significant WordPress, plugin, theme, and PHP updates.

Updates must be checked for compatibility, functionality, and security before live deployment, with an accelerated procedure for emergency security patches.

24. Database and configuration security

The provider must implement appropriate database security, secure file permissions, restricted administrative interfaces, protected configuration files, encrypted connections, and safeguards against unauthorised access to website and customer information.

7. Security Reporting and Independent Assurance

25. Monthly cybersecurity management report

The provider must deliver a monthly cybersecurity report covering:

• WordPress core, plugin, theme, and PHP update status.
• Known vulnerabilities and outstanding security risks.
• Security patches and remedial actions completed.
• Malware detection and website integrity monitoring.
• Significant suspicious activity and blocked attacks.
• Backup completion and restoration test results.
• Administrative access reviews and material access changes.
• Security incidents and unresolved issues.

26. Complete third-party software and dependency inventory

The provider must maintain a complete inventory of all software and third-party dependencies used by the website.

This must include plugins, themes, JavaScript libraries, external APIs, analytics tools, tracking scripts, embedded services, and other components that could introduce cybersecurity or data protection risks.

27. Independent cybersecurity certification and assurance

The provider should demonstrate appropriate independently assessed cybersecurity standards, such as Cyber Essentials Plus, ISO 27001, or equivalent recognised assurance.

Any certification must be current, relevant to the services provided, and independently verifiable.

Essential Contractual Principle

The website provider must not be permitted to avoid its agreed cybersecurity responsibilities simply because a vulnerability originates from WordPress, a third-party plugin, a theme developer, or the hosting company.

Where multiple suppliers are involved, the contract must clearly establish responsibility for every component of the website's security, including who monitors vulnerabilities, who applies updates, who responds to incidents, and who coordinates recovery.

The customer should have a clearly identified, accountable supplier responsible for coordinating cybersecurity protection across the entire website environment.

This accountability should be established before the website is commissioned and maintained throughout the contractual relationship.

Five Non-Negotiable Cybersecurity Requirements

While all 27 requirements are important, five should be treated as essential conditions when appointing a WordPress website provider.

1. Continuous vulnerability monitoring and urgent patching

Critical security vulnerabilities must be identified and addressed urgently, not left until the next scheduled maintenance cycle.

2. Multi-Factor Authentication and restricted access

All privileged access must be protected by MFA, with permissions restricted to those genuinely required.

3. Independent backups and tested recovery

The website and its data must be recoverable even if the primary hosting environment is compromised.

4. Independent cybersecurity testing

Security must be independently assessed and verified rather than relying exclusively on assurances from the website provider.

5. Contractual accountability and incident response

The website provider must have clearly defined contractual responsibilities, incident response procedures, reporting obligations, and agreed remediation timescales.

Conclusion

With WordPress facing a reported 4.7 million hacks annually and 88% of plugins identified as non-commercial-grade, cyber-secure plugins, businesses must recognise that cybersecurity cannot be left to automatic updates or basic website maintenance.

A WordPress website should not be considered secure simply because its software is updated, it has an SSL certificate, or a security plugin has been installed.

Effective cybersecurity requires continuous monitoring, controlled software management, secure hosting, independent testing, protected backups, strong access controls, and clearly defined supplier accountability.

Businesses should require documented evidence that these 27 cybersecurity measures are in place before appointing a WordPress website provider, and should continue to verify compliance throughout the supplier relationship.

A provider unable or unwilling to demonstrate these protections should be treated as presenting an increased cybersecurity and business continuity risk.

Ultimately, the responsibility for securing a WordPress website should not be left fragmented across plugin developers, hosting companies, and third-party suppliers. The business commissioning the website must know exactly who is accountable for protecting it, maintaining it, and restoring it if a cyberattack occurs.

Need a better, more secure recruitment website service by design? Reach out to RecruiterWEB