WordPress security: what to close in the first week

WordPress gets compromised not because it is "bad", but because there is a lot of it and it is left as it was after install: an admin user, a dozen plugins of which three are alive, and a promise to update "someday". The first week of care matters more than a yearly license for a loud security plugin.

A short order of work

• Update core, theme and plugins. Take a copy you know how to restore first.
• Remove unused plugins and themes, including the defaults nobody switches on.
• Leave the admin login behind, and leave the shared account shared by the agency, the contractor and the office.
• Switch off file editing from the admin and limit login attempts.
• Look at users with administrator rights. Extra ones are found here more often than in the code.

XML-RPC and open registration make sense only if you actually use them. Lead forms on an old plugin deserve a separate look: they often stay the door after "we updated everything". The uploads directory should not execute files.

If a WordPress site already brings leads, Lexora closes this minimum as part of an audit and can leave maintenance in place so updates do not wait for the next incident.