Outdated WordPress is the main cause of hacked websites. Updates and backups are the foundation of safe operation.
The right order of updates
- Back up both files and the database.
- WordPress core (WordPress itself).
- Themes.
- Plugins, ideally one at a time. After each group of updates, briefly go through the website.
- Delete unused themes and plugins, it is not enough to just deactivate them.
Minor core security updates are installed automatically. Automatic updates can be turned on for plugins, but for important websites we recommend testing the changes on a copy first.
Backups
We back up the server in case of a disaster, but these backups are not intended for routine restores at the customer's request. You will find details in the article Backups. That is why you should arrange your own backups:
- Use a plugin for backups that backs up both files and the database, and set a schedule (daily for frequently changing websites, otherwise weekly).
- Store backups off the server: in cloud storage or download them to your own computer. A backup in the same space takes up room and would be lost together with the website if it were hacked.
- You can also export the database manually: Importing and exporting a database in phpMyAdmin.
- Try restoring. A backup you have never restored is just an assumption.
Other recommendations
- Install only plugins that are actively maintained and well rated.
- Limit the number of users with administrator rights.
- For larger changes, use a copy of the website on a subdomain.
- Also update the PHP version and make sure your theme and plugins support it.