WordPress security: reduce the chance of abuse before something goes wrong

Why WordPress webshops attract attackers

A webshop handles accounts, orders and often personal data. A WordPress installation also combines WordPress core, a theme, plugins and external services. An outdated or poorly configured component can therefore have more impact than on a simple information site.

Automated bots continuously probe known login pages, vulnerable plugin versions, open endpoints and misconfigured servers. That does not mean every store will be hacked, but it does mean basic security is an ongoing process.

• Keep WordPress, themes and plugins actively updated.
• Remove unused plugins and themes instead of merely disabling them.
• Use unique administrator accounts and strong passwords.
• Enable 2FA for accounts with admin or shop privileges.

Reduce the login attack surface

The standard WordPress login is easy for bots to locate. Hiding the URL alone is not a complete security measure. More important is slowing repeated failed attempts, blocking suspicious IP addresses and using 2FA for administrators.

Also review whether XML-RPC or public user enumeration is genuinely required. Functionality you do not use but still expose publicly creates unnecessary attack surface.

• Rate-limit brute-force attempts with temporary lockouts.
• Use 2FA/TOTP for administrator accounts.
• Block XML-RPC if no active integration depends on it.
• Never give administrators more permissions than they need.

Security headers, HTTPS and server information

HTTPS protects traffic between the visitor and the website, but it is only one layer. Security headers can tell browsers how to handle framing, content types, referrers and allowed resources. It is also sensible not to expose unnecessary version and server details.

An overly strict Content Security Policy can break checkout or payment functionality. Always test cart, checkout, payment providers and external scripts before enforcing major header changes.

• Review HSTS, Content-Security-Policy, X-Content-Type-Options and frame protection.
• Test changes on desktop and mobile.
• Always re-test WooCommerce and payment methods after header changes.

File changes and malware

An external scanner cannot reliably prove that no malware exists inside WordPress because it cannot see every file and database record. Internal monitoring therefore matters. File-integrity monitoring compares files with an earlier baseline and can reveal unexpected changes. Static malware checks can also flag known suspicious patterns.

A warning is not automatically proof of a compromise. Updates legitimately change files and some plugins use code patterns that also occur in malware. Review anomalies in context and keep usable backups outside the web server.

• Maintain reliable backups and test restoration.
• Review unexpected changes in core, plugins, themes and uploads.
• Treat malware alerts as a reason to investigate, not as an automatic verdict.

External scanning and internal protection complement each other

A Merqivio Security Check reviews the public attack surface: HTTPS, headers, exposed WordPress signals and publicly reachable endpoints. That is useful because an attacker can inspect the same information from the internet.

Merqivio Security for WordPress works inside the installation with Login Shield, 2FA, headers, file-integrity monitoring, malware and ZIP scanning, audit logging and IP lists. Together they cover both external exposure and internal protection.