On this page
Establish a trusted installation
Use official WordPress packages and maintained plugins and themes. Avoid unlicensed or modified downloads from unknown sources. Configure the correct domain and HTTPS before accepting customer logins.
Protect administration
Use unique credentials, limited user roles, and supported account protections. Keep OS, PHP, WordPress, themes, and plugins on a supported update path. Remove access for users who no longer need it through the authorized administration interface.
Back up the whole site
Protect the database, uploads, required configuration, and custom code outside the VPS. A copy of theme files alone does not recover orders or content. Test restoration separately before updates.
For a slow site
Check resource usage, database queries, plugin behavior, and caching before increasing resources or disabling security. Test major changes in staging and preserve evidence if compromise is suspected.