Cybersecurity 
Where should WordPress security start?
Start with the hosting environment, access accounts, maintained components and a tested restoration. Then organise updates and checks of important user journeys. Security depends on an ongoing set of measures: a plugin or HTTPS padlock alone cannot establish that a website is protected.
Three foundations for ongoing care
- 01Assign responsibility for hosting, accounts and components.
- 02Test restoration and useful journeys as well as applying updates.
- 03Document alerts, interventions and limits in the maintenance agreement.
01
A WordPress website has several security layers
Official WordPress guidance treats security as risk reduction through multiple measures, including the environment, access and updates. For your business, establish who can verify and change each layer.
An agency may maintain the site while hosting and domain ownership sit elsewhere. Clarify these responsibilities before an intervention: an updated plugin does not establish the status of the server.
| Layer | Identify | Confirm the owner |
|---|---|---|
| Hosting and PHP | Environment, support and patches | Hosting or operations provider |
| WordPress, themes and plugins | Components, versions and maintenance | Website maintenance team |
| Accounts and access | Administrators, contractors and permissions | Account owner and technical team |
| Backups and restoration | Coverage and last restoration test | Recovery owner |
Sources consulted
02
WordPress updates: prepare, apply and verify
WordPress documents update procedures and recommends preparing a backup. For a business website, also specify post-change checks and what happens if an important journey no longer works.
Use a short activity-specific list: contact and enquiry delivery for a services site; cart, order and payment return for a store; sign-in, permissions and documents for a member portal. These examples organise functional acceptance, not a complete security assessment.
A critical alert may need accelerated handling. Maintenance should define who assesses the situation, applies the fix and confirms service status, coordinating compatibility checks with security follow-up.
A documented update cycle
- 01
Prepare
Identify the change, dependencies and rollback arrangements.
- 02
Apply
Change the correct environment and record the work.
- 03
Verify
Check useful journeys and document any issues.
Sources consulted
03
Accounts and plugins: review unnecessary access
Review the people and tools with access: administrators, former suppliers, hosting accounts and domain management. Define necessary permissions and how access ends when an assignment is complete. Shared accounts can make actions harder to attribute.
Inventory the themes and plugins actually used, their origin and who maintains them. A forgotten component may remain in technical scope even when it no longer appears in a visible journey. Removal must consider dependencies and stored data.
The useful output is a decision list: keep, update, replace or remove, with a reason and an owner. Plugin count alone is not a measure of security.
04
A useful backup must support restoration
WordPress guidance distinguishes website files from the database. Your records should define what is covered and where copies are held. A successful backup job alone does not establish that the site can be restored.
Arrange a restoration check in a suitable environment. Define content and journeys to validate: recent enquiries, orders, accounts or media. Frequency and retention should reflect the data loss your business can tolerate.
Restoring an older store copy may also require reconciling orders and transactions made since that copy. Planning this before an incident clarifies recovery responsibilities.
Sources consulted
05
What should a maintenance agreement make verifiable?
Describe WordPress security maintenance in tasks and evidence. Define covered environments, alert handling, post-change verification and the information you receive.
Separate subscription coverage from additional interventions: replacing a component, incident recovery, new features or a hosting migration. Availability and response arrangements should match the contract.
| Topic | Evidence or commitment to define |
|---|---|
| Scope | Websites, environments, components and hosting included |
| Fixes | Owner, prioritisation and intervention records |
| Continuity | Backup, rollback and journey checks |
| Follow-up | Reports, outstanding work and contact person |
| Incident | Contact, initial coordination and limits of intervention |
06
A checklist for your SME’s next conversation
Use the checklist to prepare a discussion with your team or provider. A checked box means you have documented information, not that your site is free of vulnerabilities. It does not replace an assessment scoped to your environment.
07
WordPress security in Belgium: prepare your Gaspa enquiry
Provide the website URL, its role in your business, observed problems and available hosting information. For a takeover, explain who currently maintains the site and how handover could be arranged.
Gaspa can examine WordPress security and maintenance requirements with you. Work and verification are defined from the existing environment. A one-off intervention differs from permanent monitoring or a specialist penetration test.
Connect maintenance with your other security needs
- October 2026 PHP vulnerabilities: verify the fixUnderstand the alert and the confirmations your environment needs.
- Cybersecurity assessments for Belgian SMEsChoose the scope across applications, penetration testing and infrastructure.
- Plan a website redesignRevisit journeys and content when a wider change is needed.