Nothing burns agency trust like the Monday-morning call that a client site is serving pharmacy spam. WordPress security across a client portfolio isn’t about one magic plugin — it’s a layered routine that makes compromise unlikely and recovery boring. Here’s the 2026 checklist I run for agency fleets.
Harden the basics (an hour per site)
- Admin accounts: unique usernames, strong passwords, 2FA enforced, and no shared “admin” login for the whole team.
- Login protection: rate limiting, and login URL obscurity as seasoning (not strategy).
- File integrity: disable file editing in wp-config, correct file permissions, PHP execution blocked in uploads.
- Database: unique table prefix on new builds, automated daily off-site backups with tested restores.
The update discipline that prevents most breaches
The overwhelming majority of WordPress compromises exploit known vulnerabilities in outdated plugins. Weekly patching with staging checks beats every firewall on the market. Cull abandoned plugins ruthlessly — a plugin without updates for 18 months is a liability wearing a feature’s clothes.
Monitor like you mean it
- Malware and file-change scanning (server-side beats plugin-only).
- Uptime and defacement alerts to a channel humans watch.
- Vulnerability feeds (Patchstack/WPScan) matched against your plugin inventory, so you patch the dangerous ones same-day.
Have an incident plan before the incident
Written and rehearsed: isolate (maintenance mode), restore from clean backup, rotate every credential, find the entry point, patch it, then request search-engine review. Agencies with a plan clean up in hours; agencies without improvise for a week while the client watches.
Sell the routine, not the fear
Security belongs inside your care plan as a named deliverable — hardening, monitoring, patching, incident response — because clients happily pay to never think about this. I run this stack white-label across agency portfolios if you’d rather own the client relationship than the 2am alerts.
