Securing a WordPress website involves more than enabling one security feature. You need to protect account access, encrypt traffic, reduce application risk, control unwanted requests, monitor activity, and prepare for recovery.

Follow the recommended path in order, or go directly to the section that matches your current security goal.

1. Understand the protections provided by Pressidium

Start by reviewing the security protections included with Pressidium Managed WordPress Hosting.

Review Pressidium Managed Hosting security to understand the platform-level controls that protect websites and infrastructure.

This overview explains which protections are managed by Pressidium and which security responsibilities remain with your team.

Continue when: You understand what the platform protects automatically and which settings you need to manage.

2. Secure your account access

A website can still be affected if an unauthorized person gains access to the account used to manage it.

Manage two-factor authentication to add a second verification step when signing in to the Pressidium Dashboard.

Review role-based Dashboard users to confirm that each team member has the appropriate level of access.

Review account activity to identify unexpected account changes or access.

Remove access for users who no longer need to manage the account or its websites.

Continue when: Authorized users can access the account securely and unnecessary access has been removed.

3. Enable and verify SSL

SSL encrypts traffic between visitors and your website.

Enable SSL for a website to activate HTTPS for the relevant domain.

Install a Let’s Encrypt certificate when you want Pressidium to issue and manage the certificate.

Upload a custom SSL certificate when your organization provides its own certificate.

After enabling SSL, open the website over HTTPS and confirm that the browser reports a secure connection.

Continue when: The production domain loads correctly over HTTPS without certificate warnings.

4. Review WordPress core, plugins, and themes

Outdated or unsupported application components can introduce security risk.

Review how Pressidium manages WordPress core updates to understand the platform’s managed update process.

Review website plugins to identify:

  • available updates
  • inactive plugins
  • plugins with reported security issues
  • plugins that are no longer required

Update website plugins after testing compatibility and creating a recent backup.

Review banned plugins on Pressidium before installing caching, backup, security, or platform-level plugins.

Remove plugins and themes that are no longer needed. Deactivating a component does not remove its files from the website.

Continue when: WordPress core, active plugins, and active themes are supported and up to date.

5. Configure website firewall controls

Use website-level firewall controls when you need to restrict requests by IP address or country.

Open the Website Firewall page to review the controls available for the selected website.

Block or allow IP addresses when you need to restrict a specific address or network range, or allow trusted traffic.

Block or allow countries when traffic from a geographic location should be restricted.

Apply the narrowest rule that achieves the required result. Broad blocking rules can prevent legitimate visitors, administrators, or external services from reaching the website.

Continue when: Required restrictions are active and legitimate users can still access the website.

6. Protect private or unfinished environments

Use Basic Authentication when a website or environment should not be publicly accessible.

Password-protect a website with Basic Authentication to require a username and password before visitors can access it.

This can be useful for:

  • staging environments
  • websites under development
  • private previews
  • sites awaiting launch

Basic Authentication is not a replacement for WordPress user authentication or website-level authorization.

Continue when: The protected environment prompts for credentials and unauthorized visitors cannot open it.

7. Review file access

Make sure that only authorized users can access website files.

Review SFTP users to identify accounts that can access the selected website.

Remove unused SFTP users and rotate credentials when access is no longer trusted.

Understand Linux filesystem permissions when you need background information about file ownership and permission values.

Reset website file permissions when permissions have been changed incorrectly or are preventing the site from operating normally.

Continue when: Only authorized users have file access and the website uses the expected file permissions.

8. Monitor website activity

Security monitoring helps you identify unusual requests, repeated access attempts, and application errors.

Review the Access Log page to examine requests made to the website.

Review the Error Log page to identify PHP, WordPress, plugin, or theme errors.

Review website analytics to identify unexpected traffic changes or unusual resource use.

When investigating an event, record:

  • the affected domain
  • the date and time
  • the requested URL
  • the source IP address, when available
  • any related error or response code

Continue when: You know where to review website activity and how to collect useful diagnostic information.

9. Prepare for recovery

Security planning should include a way to restore the website if a change, compromise, or incident affects it.

Review Pressidium backups and retention to understand the available backup types and retention periods.

Create an Instant backup before making significant application or configuration changes.

Restore an Instant backup when you need to return the website to a known working state.

A backup restores website data. It does not explain how the original issue occurred. Continue investigating the cause before returning the website to normal operation.

Choose the right security action

Your situationRecommended action
You are reviewing security for the first timeStart with the platform security overview, account access, SSL, and application updates
A new team member needs accessReview role-based Dashboard access and enable two-factor authentication
A staging site should not be publicEnable Basic Authentication
A specific IP address is sending unwanted requestsAdd the address to the website IP Blocklist
Trusted traffic is being blockedReview the IP Allowlist and existing firewall rules
Traffic from a country should be restrictedReview Geo-blocking controls
A plugin has a reported vulnerabilityUpdate, replace, or remove the plugin after testing
The website shows unexpected file changes or permission errorsReview SFTP access and file permissions
You see suspicious trafficReview access logs, firewall activity, and traffic analytics
You are locked out of the websiteFollow the account or website access troubleshooting guide
The website stopped working after a security-related changeReverse the change or restore a recent backup

Verification

After completing the relevant security actions, confirm that:

  • two-factor authentication is active for the appropriate account users
  • unnecessary Dashboard and SFTP access has been removed
  • the production domain loads securely over HTTPS
  • active plugins and themes are supported and updated
  • unwanted or unsupported plugins have been removed
  • firewall rules block the intended traffic without affecting legitimate users
  • private environments require authentication
  • website logs and monitoring information are accessible
  • a recent backup is available
  • the website continues to operate normally

Security is an ongoing process. Repeat this review after major website changes, team changes, migrations, or security events.

Common issues and solutions

Legitimate traffic is blocked

Review recent firewall, IP, and Geo-blocking changes.

Resolve legitimate traffic blocked by the firewall to identify the matching rule and restore access safely.

You cannot access WordPress Admin

Resolve WordPress Admin access issues to check credentials, security restrictions, plugin conflicts, and application errors.

You have been locked out of the website

Recover access to a locked website to identify whether the restriction comes from WordPress, the website firewall, IP rules, or account access.

The website shows a certificate warning

Resolve SSL certificate errors to check certificate status, domain configuration, and DNS.

A plugin or theme causes an error after an update

Resolve plugin compatibility problems or resolve theme display issues to identify the affected component and restore the website.

File permissions appear incorrect

Reset website file permissions to restore the platform’s expected permission values.

Need help?

Contact Support when:

  • you suspect that the website or account has been compromised
  • legitimate traffic remains blocked after reviewing firewall rules
  • you cannot restore account or website access
  • unexpected files or changes continue to appear
  • SSL errors remain after checking the domain and certificate
  • the website remains unavailable after reverting recent changes

Include:

  • the website name and domain
  • the affected environment
  • the date and approximate time of the event
  • the affected URL
  • relevant source IP addresses
  • screenshots of errors or Dashboard settings
  • related log entries
  • recent changes made before the issue began

Do not send passwords, recovery codes, private keys, or other sensitive credentials in a support request.

Where to go next