Security is an ongoing process, not a one-time plugin installation. Begin with the controls that prevent the most common account and software compromises.
### Essential checklist
1. Use a unique administrator username and a long password stored in a password manager.
2. Enable two-factor authentication for administrator accounts when supported.
3. Delete unused administrator accounts.
4. Update WordPress core, themes, and plugins regularly.
5. Remove themes and plugins that are not needed; inactive vulnerable software can still be attacked.
6. Install extensions only from trusted sources and avoid pirated “nulled” products.
7. Use HTTPS for the entire site.
8. Schedule backups and keep at least one copy outside the hosting account.
9. Give users only the role they require.
10. Protect forms with spam and abuse controls.
11. Review security alerts and login activity.
12. Test restoration, not only backup creation.
### Before applying updates
Create a backup, review compatibility notes for major updates, and update during a low-traffic period. Test important pages, checkout flows, forms, and the dashboard afterward.
### If compromise is suspected
Place the site in a controlled maintenance state if necessary, preserve logs, change passwords from a clean device, rotate application and database credentials, and seek professional cleanup. Simply deleting the visible malicious file may leave the original vulnerability or another backdoor in place.
**Related articles:** How to Fix SSL Problems; How to Create and Restore a cPanel Backup; Troubleshooting the WordPress Critical Error