Recommendation WordPress: Basic Security and What to Check If You Buy a Website Built with WordPress

[Luis Colmenarez]

WordPress powers a huge portion of the web, which is why it’s also a frequent target of attacks. Here are the basics for protecting it and for evaluating a website before purchasing it.

1. Basic Safety

• Keep everything up to date: the core, theme, and plugins.
• Remove what you don't use: inactive plugins and themes are a security risk.
• Strong passwords and 2FA for all administrators.
• Change the "admin" username if you're still using it.
• Automatic off-server backups (files and database).
• Security and firewall plugin: Wordfence, Sucuri, or similar.
• Download themes and plugins only from official sources or directly from the author. "Nulled" versions often contain malware.

2. What to Look for When Buying a WordPress Website

• Administrator users: In the dashboard, go to "Users" and check to make sure there are no unknown accounts.
• Plugins and theme: Are they licensed and up to date? Are any of them abandoned?
• Performance: Use PageSpeed Insights to measure performance and see how many resource-intensive plugins there are.
• Content: Make sure it's original and doesn't contain any suspicious links.
• Malware: Scan your site with a security plugin and check Search Console for any security warnings.
• Access: Request the WordPress dashboard, hosting, domain, Search Console, and Analytics, and change all passwords after purchase.

3. General Best Practices

• Use a lightweight, well-maintained theme.
• Test major changes on a staging environment before deploying them to production.
• Install only the plugins you really need.

Do you use WordPress or another CMS (Joomla, PrestaShop, Shopify, etc.)? Tell us about your experience and your favorite plugins.