A large share of Indian business websites run on WordPress, and a large share of those get compromised at some point — usually turned into a host for spam pages, a redirect to somewhere else, or a crypto miner. The owner discovers it when Google flags the site or a customer mentions it. Almost none of these compromises exploit WordPress core, which is maintained carefully; they come through plugins, themes and credentials.
Plugins are the largest exposure and the easiest to reduce. Every plugin is code from a stranger running with full access to your site and database. Audit what is installed, deactivate and delete anything not actively used — deactivated plugins still sit on disk and can still be exploited — and check when each remaining one was last updated. A plugin abandoned two years ago is a vulnerability waiting to be published. Enable automatic updates for plugins and core, and accept the small risk of an update breaking something over the larger risk of running known-vulnerable code.
Themes deserve the same treatment and get less attention. Nulled or pirated premium themes, which circulate widely, frequently contain deliberately inserted backdoors — that is the business model behind distributing them free. If a site was built cheaply and quickly, checking the provenance of the theme is worth doing before anything else. Delete unused themes entirely rather than leaving them installed.
On access, the basics eliminate most opportunistic attacks. Remove the default admin username. Give each person their own account at the lowest role that lets them do their job — an editor does not need administrator. Enforce strong unique passwords and enable two-factor authentication on every administrator account. Limit login attempts so a password can't be guessed indefinitely. And remove accounts belonging to people who have left, including the developer who built the site three years ago and still has full access.
Then the hosting layer, which most owners never touch. Keep PHP on a supported version — a great deal of Indian shared hosting is still running versions that stopped receiving security fixes years ago. Ensure file permissions are correct and that the web server cannot write where it does not need to. Put a web application firewall in front, which any CDN provides, and it will absorb the constant background scanning that every WordPress site receives. Disable file editing from the admin panel, which is one line in the configuration and removes a favourite attacker technique.
Finally, have backups you have actually restored. Automated daily backups stored somewhere other than the same server, with a restore tested at least once so you know it works and how long it takes. This is what converts a compromise from a crisis into an afternoon: restore to a point before the intrusion, patch what let them in, change every credential. Without a tested backup, cleaning a compromised WordPress site is a specialist job, it costs more than a year of good hosting, and you are never entirely certain it is clean.
