WordPress security: 2026 monthly maintenance plan

90% of WordPress sites hacked in 2025 were compromised through 3 vectors: outdated plugins, weak passwords, cheap shared hosting. A monthly 90-minute routine eliminates 95% of risk. Here's the concrete checklist.

Monthly maintenance (90 minutes total)

1. Verified full backup (site + DB) — from hosting or UpdraftPlus + cloud storage
2. Update WP core, theme, plugins — check key plugin changelogs for notable changes
3. Vulnerability scan with Wordfence or iThemes Security (free)
4. Check active users: remove old admins, verify suspicious accesses in log
5. Audit obsolete plugins: remove those not updated >6 months (high security risk)
6. Performance check: PageSpeed Insights, optimise large images if added
7. Verify SSL and HTTPS redirect
8. Test critical functions: contact form, checkout (if e-commerce), admin login

One-shot security setup (4 hours, one-time)

• Limit Login Attempts (Wordfence) — blocks brute force
• 2FA for all admins — free Google Authenticator
• WAF (Cloudflare free) — blocks DDoS attacks and bots
• Disable XML-RPC if unused (Jetpack uses it)
• Hide login URL: change /wp-admin to something non-standard
• Non-standard database prefix (never default "wp_")

What never to do

• Update WP core Friday afternoon (if it breaks, panic weekend)
• Keep abandoned free plugins (1+ year without updates = remove)
• Save admin passwords in plain text in email/Slack
• Use €30/year shared hosting for business-critical sites

Have a WordPress site you want to maintain without worry? All included in the Care package €89/month: automatic off-site backups, uptime monitoring, managed updates.

Want to apply this to your SME?

If you'd like a concrete analysis of your situation, request the free audit from Gamerbit. In 48 hours we tell you exactly where you're losing leads, time or budget — no sales pitch.

For a complete system, the 2026 no-brainer offers are the most direct starting point.