“I have WordPress updated, so I'm safe.”
It is the most widespread belief and the most dangerous, because it generates a tranquility that is not justified. Updating is necessary, but it is not enough.
Let's see what it really covers and what is left out.
What does updating resolve?
Let's start with the good, which is a lot. Keeping WordPress, plugins and theme up to date closes known vulnerabilities, and those are the entry point for the vast majority of automated attacks.
Bots do not look for specific targets: they scan the internet looking for vulnerable versions published on public lists. If you are updated, that scan passes by.
That's why updating is the first thing. Only it's not the only thing.
What it does not cover
1. Weak passwords
You can have everything updated and an administrator user with the password Empresa2024. Brute force attacks try thousands of combinations per minute against the login page, and they don't require any vulnerabilities: just patience.
Add to this that many people reuse passwords. If that same key appeared in the leak of another service, it is already on the lists that attackers use.
What to do: long and unique passwords, a password manager, and above all two-factor authentication for administrator users. With 2FA, even if they get the password right, they don't get in.
2. The “admin” user
If your administrator user is called admin, you've given attackers half the job: they just have to guess the password.
Create a new user with a different name, give it administrator permissions, and delete the old one by reassigning its content.
3. Poorly distributed permissions
It is common for everyone in the company to have administrator permissions “for convenience.” The intern who only blogs, the marketing person, the external designer who worked two years ago and still has access.
Each administrator is another door. WordPress has roles with limited permissions for a reason: use the minimum necessary for each person.
And when someone stops collaborating, remove their access that same day.
4. Misconfigured legitimate software
Many problems do not come from malicious code but from sloppy configurations: open directory listings, backup files accessible from the browser, the public debug.log file with internal paths, or a wp-config.php with overly permissive permissions.
An update fixes none of that.
5. Hosting
Your WordPress may be flawless and the server may have an outdated PHP version without security patches. In poorly isolated shared hosting, even another client's infected website can affect you.
6. Zero-day vulnerabilities
They are the ones that do not yet have a patch because they have just been discovered. By definition, being up to date does not protect against them. It is rare on small websites, but it is good to know that it exists: it is the reason why security is considered in layers and not as a box that is checked.
The layers that are missing
Without getting paranoid, this is what is reasonable for an SME website:
- Double factor in administrators. It is the measure with the best relationship between effort and protection
- Limit access attempts, so that brute force is not viable
- Change the access URL. It's not real security, but it eliminates almost all the automated bot noise at once
- A firewall that filters malicious requests before they reach WordPress
- External backups. They do not prevent, but they turn a disaster into a setback
- Review who has access, from time to time
What no one can promise you
Here it is important to be clear, although commercially it is less attractive: no provider can guarantee that your website will never be attacked.
If someone promises it to you, either they don't know what they're talking about or they're exaggerating to close the sale. Any system connected to the internet is attackable.
What can be done, and it is a lot:
- Dramatically reduce the probability, closing the routes through which 95% of attacks enter
- Detect it early if it happens, rather than weeks later
- Have a way back: a clean and recent copy to restore
That's the difference between a one-afternoon scare and a two-week crisis.
The least you can do this week
If you are only going to do three things:
- Activate double factor in your administrator user
- Review the list of users and remove those who should no longer have access
- Check that you have backups off your server and that they work
They are free, done in an afternoon, and cover a good part of the real risk.
The rest—firewall, monitoring, periodic review, verified updates—is what we include in our maintenance service. Not because you can't do it, but because it requires perseverance, and perseverance is just what is missing when you have a business to run.
Would you prefer us to review it? Take a look at our WordPress maintenance service either tell us what your website needs and we will respond to you in less than 24 hours.