WordPress Security: The Practical Guide for Australian Business Owners (2026)

By Bradley Austin | Updated June 2026 | 15 min read

Every six minutes, an Australian business reports a cybercrime incident to the government. That’s according to the Australian Signals Directorate’s 2024–25 Annual Cyber Threat Report – 84,700 reports in a single financial year, with the average cost of an attack on a small business rising 14% to $56,600.

For businesses running WordPress, the platform behind 43% of the entire web, the threat is especially direct. Wordfence, the most widely deployed WordPress security plugin, currently blocks 55 million exploit attempts and 6.4 billion brute-force attacks every single month across its network. Most of those attacks are fully automated. Bots scan every IP on the internet, identify WordPress installations, probe for known vulnerabilities, and attempt to break in – regardless of whether your site gets 50 visitors a month or 50,000.

The good news is that the vast majority of WordPress hacks are entirely preventable. 90% of WordPress vulnerabilities originate in plugins and themes, and not WordPress itself. The platform is fundamentally solid. What leaves sites exposed is neglected updates, weak passwords, unsecured hosting control panels, and the absence of a few straightforward protective layers.

This guide gives you a plain-English checklist, ordered by impact. You don’t need to be technical to follow it. The first four steps alone will protect you against the bulk of what’s targeting your site right now.

Why WordPress Is Targeted – And Why Your Business Size Doesn’t Matter

It’s tempting to assume your site is too small to be worth attacking. That’s not how modern cybercrime works.

Attackers aren’t sitting at a keyboard choosing you specifically. They’re running automated scripts that scan millions of websites simultaneously, looking for anything with a known vulnerability. In 2025, 11,334 new vulnerabilities were recorded in the WordPress ecosystem – a 42% jump year-on-year, according to Patchstack’s State of WordPress Security report. When a vulnerability is discovered in a popular plugin, the median time before mass exploitation begins is just 5 hours. That window is almost never long enough for a business owner to notice and apply a patch.

57% of vulnerabilities discovered in the first half of 2025 required no authentication whatsoever to exploit. Meaning an attacker doesn’t even need to guess a password – they can walk straight through an unpatched door. And 46% of vulnerabilities have no available patch at the time of public disclosure, which means there’s often nothing to update to; you need layered defences in place before a vulnerability becomes public knowledge.

The cost of getting it wrong is real. A successful attack doesn’t just take your site offline for a few hours. It can:

• Get your site blacklisted by Google – triggering a “Deceptive site ahead” warning that tanks your organic traffic overnight, burns your ad spend, and destroys the trust you’ve built
• Trigger mandatory government reporting – if your site stores customer data, a breach may require notification under the Notifiable Data Breaches (NDB) scheme
• Damage your email reputation – attackers often use compromised sites to send spam, getting your domain blacklisted by email providers and destroying deliverability for your marketing campaigns and even invoices to customers
• Destroy months of SEO work – Google penalises hacked sites heavily, and recovery can take weeks or months even after the site is cleaned

Your WordPress Security Checklist (13 Essential Steps)

This checklist is ordered by impact. Start at the top.

Step 1: Choose Australian-Based, Security-Aware Hosting

Your hosting environment is the foundation everything else sits on. A poorly secured server can expose your WordPress site regardless of what you do inside WordPress itself.

For Australian businesses, local hosting has specific advantages beyond speed. Australian-based servers keep your customer data under Australian jurisdiction, which simplifies compliance with the Privacy Act. They also typically offer better support hours aligned with your business day.

What to look for in a host:

• Australian-based servers (not just an Australian brand on international infrastructure)
• DDoS protection at the network level
• Automated daily or hourly backups stored off-site
• Free SSL certificate included
• Malware scanning at the server level
• Managed WordPress options if you want less hands-on involvement

Step 2: Secure Your Hosting Control Panel (cPanel) With 2FA

Most WordPress sites sit inside a hosting control panel – typically cPanel. This is the dashboard where you manage files, databases, email accounts, and often WordPress itself. It’s also a significant attack surface that most business owners never think about.

If an attacker gains access to your cPanel, they have access to everything: your WordPress files, your database (which contains all your customer data), your email accounts, and the ability to install anything they like on your server. A strong WordPress password means nothing if your cPanel account uses a weak one with no second factor.

How to enable 2FA in cPanel:

1. Log into your cPanel account
2. Navigate to Security → Two-Factor Authentication
3. Click Get Started
4. Open an authenticator app on your phone (Google Authenticator, Authy, or Microsoft Authenticator)
5. Scan the QR code cPanel displays
6. Enter the 6-digit code your app generates to confirm it’s working
7. Save your backup codes somewhere secure (not on the same device)

cPanel uses TOTP (Time-based One-Time Password) – the same industry-standard protocol used by banks and government services. Once enabled, every login requires both your password and a live 6-digit code from your phone.

If you have WHM (reseller/admin) access: Go to Security Center → Two-Factor Authentication and enforce 2FA for all cPanel accounts under your management. This is especially important if you have a web developer, VA, or agency with access to your hosting environment.

Authenticator app recommendation: Use LastPass or Authy over Google Authenticator. They support encrypted cloud backups, so you’re not locked out if you lose your phone.

Step 3: Add Cloudflare for Traffic Filtering and Network-Level Protection

Cloudflare is a content delivery and security network that sits between the internet and your website, inspecting every incoming request before it reaches your server. Think of it as a security checkpoint at the front door; legitimate traffic gets through instantly, while known malicious traffic and bots get blocked before they ever touch WordPress.

The free Cloudflare tier is genuinely useful for most small business sites and takes about 20 minutes to set up.

What Cloudflare’s free tier gives you:

• DDoS protection – absorbs volumetric attacks before they reach your server
• Bot Fight Mode – blocks known malicious bots and scrapers automatically
• Web Application Firewall (WAF) rules – create custom rules to block attack patterns (e.g. block all requests to /wp-login.php from countries you don’t do business in)
• SSL/TLS termination – full encryption between visitors and Cloudflare, and between Cloudflare and your server
• Rate limiting – restrict how many times an IP can hit your login page per minute

Useful WAF rules for WordPress (free tier):

These are copy-paste custom rules you can add in Cloudflare’s dashboard under Security → WAF → Custom Rules:

• Block XML-RPC: (http.request.uri.path contains “/xmlrpc.php”) → Block
• Rate-limit login attempts: (http.request.uri.path contains “/wp-login.php”) → Challenge (with rate limit: 5 per minute per IP)
• Block wp-admin from outside Australia: (http.request.uri.path contains “/wp-admin”) and not (ip.geoip.country in {“AU”}) → Block (only use this if your team is Australia-based)
• Block known bad user agents: (http.user_agent contains “sqlmap”) or (http.user_agent contains “nikto”) or (http.user_agent contains “masscan”) → Block

Pro tip: After connecting Cloudflare, lock your server’s firewall to only accept connections from Cloudflare’s published IP ranges. This prevents attackers from bypassing Cloudflare entirely by connecting directly to your server’s IP address.

Step 4: Go Further With Cloudflare Zero Trust Access (Free)

Cloudflare’s Zero Trust product, specifically Cloudflare Access – goes a step beyond WAF rules. Instead of just filtering traffic, it puts an authentication gate in front of your WordPress admin and login pages so that only verified, approved people can even see them.

The principle is simple: no one reaches /wp-admin or /wp-login.php unless they’ve already proven who they are. Bots, scanners, and credential-stuffing attacks never get a login form to interact with at all.

Cloudflare Access is free for up to 50 users – more than enough for most small businesses.

How it works:

1. You configure an “Access Application” in the Cloudflare Zero Trust dashboard scoped to your domain’s /wp-admin and /wp-login.php paths
2. Cloudflare sits in front of those URLs and shows its own authentication screen first
3. Users verify via email OTP (one-time code), Google Workspace, Microsoft 365, or another identity provider
4. Once authenticated through Cloudflare, they’re allowed through to the actual WordPress login page (where they still enter their WordPress credentials + 2FA)

This creates two independent authentication layers before anyone can attempt a WordPress login. Brute-force attacks become essentially impossible – they can’t even reach the login form.

To set it up:

1. Log into one.dash.cloudflare.com and navigate to Access → Applications → Add an Application → Self-hosted
2. Set the application domain to your site (e.g. yourdomain.com.au)
3. Add paths: /wp-admin* and /wp-login.php
4. Configure a policy: add the email addresses of everyone who should have access
5. Set the authentication method (email OTP is the simplest – no external accounts required)
6. Save and test

Important: Cloudflare Zero Trust only protects what it can see. Ensure Cloudflare’s DNS proxy (orange cloud icon in your DNS settings) is active for your domain, and restrict direct server access to Cloudflare IPs as noted above.

Step 5: Keep WordPress Core, Plugins, and Themes Updated

This is the single most impactful security action on this list, and also the most frequently neglected.

In 2025, plugins accounted for 90% of all WordPress vulnerabilities. Attackers specifically target popular plugins because a single vulnerability in a plugin with one million installs gives them one million potential targets. When a patch is released, the race begins: researchers publish the vulnerability details, and automated scanners start probing for unpatched sites within hours.

What to update and how often:

• WordPress core: Enable auto-updates for minor releases (security patches). Review major releases on a staging copy first.
• Plugins: Check weekly and apply any pending updates. If a plugin bills itself as a “set it and forget it” tool, check that it’s still actively maintained (last update date visible on wordpress.org).
• Themes: Update your active theme promptly. If you have inactive themes installed, delete them – deactivated code is still exploitable.
• PHP version: Your hosting should run PHP 8.2 or later. Earlier versions no longer receive security patches. Check under Software in cPanel.

Delete what you don’t use. Every dormant plugin sitting on your server is potential attack surface. If you’re not actively using it, remove it entirely – don’t just deactivate it.

Step 6: Enable Two-Factor Authentication for All WordPress Admin Accounts

With brute-force attacks on WordPress surging 60% year-on-year, a strong password alone is no longer sufficient. Two-factor authentication adds a second verification step – a time-sensitive code from your phone – that blocks automated credential attacks even when a password has been compromised or guessed.

Every person with a WordPress Administrator or Editor account on your site needs 2FA enabled. Not just you.

Free plugins that add 2FA:

• WP 2FA – simple setup wizard, works with any authenticator app, supports email backup codes
• Wordfence Login Security – included with Wordfence, handles both login protection and 2FA in one plugin
• miniOrange Google Authenticator – flexible, supports multiple 2FA methods

Also change the default username if it’s still set to ‘admin’. Attackers running credential-stuffing attacks already have half your login when the username is predictable. They just need to guess the password.

Step 7: Limit Login Attempts and Secure Your Login Page

WordPress allows unlimited login attempts by default. Combined with automated tools testing thousands of combinations per minute, this makes brute-force attacks straightforward. A login limiter fixes this immediately.

Login security checklist:

• Limit Login Attempts Reloaded (free plugin) – locks out an IP after a set number of failed attempts (3–5 is standard)
• Change the login URL – WordPress defaults to /wp-login.php, which every bot scanner checks first. WPS Hide Login lets you rename it to anything. This alone removes your site from the vast majority of automated scans.
• Add CAPTCHA – a simple checkbox challenge stops bots from reaching the login form at all. Cloudflare’s Turnstile is a privacy-friendly alternative to Google reCAPTCHA and integrates easily with WordPress.

Note: If you’ve implemented Cloudflare Zero Trust (Step 4), bots can’t reach your login page at all. Login limiters and CAPTCHA are still worth having as a second layer, but Zero Trust makes brute-force attacks functionally impossible.

Step 8: Use Strong, Unique Passwords for Every Account

A recent Patchstack report found that 81% of hacked WordPress sites involved weak or stolen passwords as a contributing factor. The problem often isn’t the WordPress password itself – it’s that the same password was reused from another service that was previously breached.

Credential stuffing works by taking password lists leaked from breaches (LinkedIn, Adobe, Canva, and thousands of others have all had major leaks) and systematically testing them against WordPress login pages. If you’ve ever reused a password, it’s likely already in one of these lists.

What to do:

• Use a password manager – 1Password and Bitwarden are both excellent. Let it generate and store unique passwords for every account.
• Your WordPress admin, cPanel, FTP, database, and email accounts all need separate, unique passwords.
• 16+ characters minimum. Your password manager will handle this automatically.
• Check haveibeenpwned.com to see if your email addresses appear in known breach databases.

Pro tip: Avoid using generic personal providers like Gmail or Hotmail for administrator accounts without full security hardening. Opting for a domain-based email address is generally superior, as these accounts typically benefit from more robust monitoring and professional-grade security controls.

Step 9: Install a Security Plugin

A security plugin is your on-site monitoring layer. It scans for malware, monitors file changes, and blocks attack patterns that get past your external defences. Think of it as a security camera system inside the building, after the front door.

Don’t run two security plugins simultaneously, as they conflict with each other and can break your site.

Choose one from this list:

Plugin	Free Version	Best For
Wordfence	Yes	All-round protection – WAF, malware scanner, login security, 2FA
Solid Security (ex-iThemes)	Yes	Site hardening – login lockdown, file change detection
Sucuri Security	Yes (paid for WAF)	Monitoring + post-hack support – pairs well with their cloud WAF

After installing, configure it. Don’t assume default settings are optimal. Enable email alerts for malware detections and failed login spikes. Schedule weekly malware scans at minimum.

Step 10: Enable a Web Application Firewall (WAF)

If Cloudflare handles network-level filtering (Step 3), a plugin-based WAF handles application-level filtering – blocking attacks that are specific to WordPress, like XML-RPC abuse, wp-config.php access attempts, and known plugin exploit patterns.

Wordfence Premium includes the most comprehensive WordPress-specific WAF rules, updated in real time as new vulnerabilities are discovered. The free Wordfence WAF runs on a 30-day delay for new rules, which is adequate for most small business sites.

If you’re using Cloudflare, you already have a network-layer WAF. Adding Wordfence gives you a second, WordPress-specific layer. The two don’t conflict.

Step 11: Set Up Automated Off-Site Backups

A recent, clean backup is the difference between a hack being a minor inconvenience and a catastrophic business loss. If your site is compromised and you have a clean backup from 48 hours ago, you restore, update the vulnerable software, and you’re back online. Without a backup, you’re looking at a professional malware cleanup, possible data reconstruction, and potentially starting from scratch.

The 3-2-1 backup rule:

• 3 copies of your data
• 2 different storage types (e.g. your server and a cloud service)
• 1 copy stored off-site (never on the same server as your live site)

Free and affordable options:

• UpdraftPlus (free) – schedule automatic backups to Google Drive, Dropbox, or Amazon S3
• BlogVault – paid but excellent, includes one-click restore and backup testing
• Your hosting provider – Klarity Lab’s hosting includes hourly Acronis backups; check whether your current host’s backups are stored separately from your main server

Test a restore at least quarterly. A backup you’ve never tested is an untested assumption. The first time you discover a backup is broken shouldn’t be after a hack.

Step 12: Run Regular Malware Scans and Monitor Your Site

Security issues often go undetected for weeks or months. Attackers increasingly inject code into existing files rather than creating new obvious ones, making compromised sites look completely normal to the naked eye while serving malware to visitors or redirecting search engine traffic.

How to stay on top of it:

• Configure your security plugin (Wordfence, Sucuri, or MalCare) to run weekly malware scans and email you the results
• Enable file integrity monitoring – this alerts you the moment a core WordPress file is modified unexpectedly, which is often the first sign of a compromise
• Use Sucuri SiteCheck (sitecheck.sucuri.net) for a free external scan. It checks your site’s publicly visible files against known malware signatures and blacklists
• Set up uptime monitoring – services like UptimeRobot (free) alert you immediately if your site goes offline, which can indicate an attack or hosting issue

Step 13: Know Your Australian Legal Obligations

If your website collects personal information from customers – and almost every business website does, whether through contact forms, email newsletter signups, or e-commerce transactions – you have obligations under Australian law that most business owners aren’t aware of.

The Privacy Act 1988 and the Notifiable Data Breaches (NDB) Scheme

Under the NDB scheme, if your business experiences an “eligible data breach” – meaning personal information is accessed, disclosed, or lost in circumstances likely to result in serious harm – you are legally required to:

1. Notify affected individuals as soon as practicable
2. Notify the Office of the Australian Information Commissioner (OAIC)

A hacked WordPress site that exposes customer names, email addresses, phone numbers, or payment information almost certainly qualifies as an eligible data breach. Failing to notify can attract significant penalties from the OAIC.

What this means practically:

• Know what personal information your site collects and where it’s stored
• Document your security measures (this checklist is a good start)
• Have a written incident response plan. Who does what if you discover your site has been compromised?
• Contact your hosting provider immediately if you suspect a breach
• Seek qualified legal or privacy advice for your specific situation – the OAIC website has plain-English guidance

The NDB scheme applies to businesses with an annual turnover of over $3 million, most health service providers, and certain other organisations. If you’re under that threshold but handle health information, credit information, or certain other sensitive data, the scheme may still apply. Check with a privacy professional if you’re unsure.

What to Do If Your WordPress Site Gets Hacked

Even with all of the above in place, a breach can still happen through a newly disclosed zero-day vulnerability, a supply chain attack on a plugin you use, or a team member’s compromised credentials. If it does, stay methodical. We’ve seen many businesses through this. It’s recoverable.

The step-by-step recovery process:

1. Don’t panic. A methodical response protects you better than a rushed one.
2. Put the site into maintenance mode. Stop the malware from spreading to visitors. Most security plugins have a one-click maintenance mode; alternatively, ask your hosting provider to restrict public access temporarily.
3. Change every password connected to your site. WordPress admin accounts, cPanel, FTP/SFTP, your database, and every email address on the domain. Do this before you do anything else – if you clean the site without changing credentials, the attacker still has the key.
4. Contact your hosting provider. They can often identify the entry point, isolate the compromised account, and may be able to assist with cleanup or provide a clean backup.
5. Run a full malware scan. Use Sucuri SiteCheck, Wordfence, or MalCare to map the scope of the infection and locate backdoors the attacker may have planted.
6. Restore from a clean backup if you have one. This is the fastest path to a clean site. Confirm the backup pre-dates the compromise – your hosting or backup plugin logs should show timestamps.
7. Update everything after restoring. WordPress core, every plugin, every theme, and your PHP version. The vulnerability that allowed entry must be patched before you go back online.
8. Audit all user accounts. Delete any admin accounts you don’t recognise and reset passwords for all legitimate accounts. Check your activity logs to understand what the attacker accessed.
9. Submit for Google review. If Google has flagged your site with a “Deceptive site” warning, submit a reconsideration request through Google Search Console once the site is clean. The warning stays until you do this.
10. Assess your NDB obligations. If customer data may have been accessed, seek legal or privacy advice promptly about whether you have mandatory notification obligations.

The Easiest Way to Stay Protected Long-Term

Reading this guide and acting on it once is a good start. The challenge is that WordPress security isn’t a project you finish – it’s an ongoing routine. Plugins release updates weekly. New vulnerabilities are disclosed constantly. A site that’s secure in January may have an unpatched plugin vulnerability by March.

For most business owners, the realistic choice is: build and maintain this routine yourself, or delegate it to someone who does it every week as their job.

Klarity Lab’s WordPress Website Care Plans handle all of this for $100/month + GST, including:

• Weekly backups to our secure off-site servers
• WordPress core, plugin, and theme updates – tested before being applied
• Virtual patching of known vulnerabilities
• Website hardening across your WordPress and hosting environment
• Web application firewall and malware scanning
• Uptime monitoring with alerts managed by our team
• Monthly security reports so you always know where things stand

If something is found, we notify you before taking action. No surprise bills, no work done without approval.

Frequently Asked Questions

Sources and References

The statistics in this article are drawn from the following primary sources, all published in 2025 or 2026. Security data shifts quickly – we review and update this article every six months.

• ASD Annual Cyber Threat Report 2024–25 – Australian Signals Directorate / Australian Cyber Security Centre. Source for: 84,700 cybercrime reports, $56,600 average small business cost, one report every 6 minutes.
• State of WordPress Security in 2026 – Patchstack (covers full-year 2025 vulnerability data). Source for: 11,334 vulnerabilities (42% increase), 90% plugin origin, 5-hour exploitation median, 46% unpatched at disclosure, 81% weak/stolen password involvement.
• 2025 Mid-Year Vulnerability Report – Patchstack. Source for: 57% of H1 2025 vulnerabilities required no authentication.
• Wordfence Intelligence – Wordfence. Source for: 55 million monthly exploit attempts, 6.4 billion monthly brute-force attacks, 60% year-on-year surge in brute-force activity.
• Office of the Australian Information Commissioner – NDB Scheme – OAIC. Source for: Notifiable Data Breaches scheme obligations and thresholds.

Need help securing your WordPress site or managing it on an ongoing basis? Contact the Klarity Lab team or explore our WordPress Website Care Plans – we look after WordPress sites for businesses across Penrith and Australia.