The 15-minute WordPress safety check

WordPress powers a huge chunk of the web, which makes it a popular target. The good news: most break-ins exploit the same handful of avoidable things. Set these up once and you're ahead of the curve.

The checklist

• Delete plugins you don't use. An inactive plugin is still code on your server.
• Update core, themes and plugins — or let Sling do it overnight.
• Use a long, unique password and a password manager. Yes, even for a hobby site.
• Turn on two-factor authentication for your admin account.
• Never use “admin” as a username. It's the first guess in every automated attack.
• Remove the “anyone can register” setting unless you actually need it.
• Keep one backup from before any big change, not just the automatic ones.
• Check that your padlock works on both yoursite.com and www.yoursite.com.
• Delete old themes. Unused themes can still carry vulnerabilities.

What Sling handles for you

Automatic WordPress core and plugin security updates, a firewall that filters known-bad traffic, weekly malware scans, and an email if anything looks odd. You still own the password hygiene — that part we can't do for you.

If you think you've been hit

Don't start deleting files. Take a snapshot first (yes, even of the compromised site), then contact support. Restoring a clean backup and rotating passwords is usually faster and safer than trying to surgically remove whatever got in.