发布前，若步骤依赖主机商，我们会在至少两家平台各走一遍；否则在同一环境隔日执行两次。我们记录控制台报错、不同地区的界面文案差异，并在厂商调整按钮位置后立即更新文案。路径与截图每季度抽检。涉及 DNS、SSL 或付款时，我们确认回滚/补救选项，并链接到官方文档以获取权威表述。
The single most effective security measure. Over 50% of WordPress hacks exploit vulnerabilities in outdated plugins and themes. Enable automatic updates: Plugins → select all → Bulk Actions → Enable Auto-updates. For WordPress core, in wp-config.php add `define('WP_AUTO_UPDATE_CORE', true);`. Before enabling auto-updates, ensure you have automated backups running so you can revert if an update causes issues.
All WordPress accounts should use 20+ character randomly generated passwords. Use a password manager (Bitwarden is free and excellent, 1Password is premium). Never reuse passwords across sites. Change your database password to something complex in wp-config.php and in your hosting control panel. Your wp-config.php database password doesn't change how WordPress logs in. It's a separate credential.
Install Wordfence Security (free tier is comprehensive) or Solid Security (formerly iThemes Security). Enable: malware scanning, login security, brute force protection, and file change detection. Run the initial security audit and fix all flagged issues. Schedule weekly malware scans. These plugins detect many attacks before they cause damage and alert you to suspicious activity.
Add 2FA to your WordPress admin login. even if your password is compromised, attackers cannot log in without your phone. Wordfence Security and Solid Security both include 2FA. Alternatively, install WP 2FA plugin. Use an authenticator app (Google Authenticator, Authy) rather than SMS. SMS is vulnerable to SIM-swap attacks.
The username "admin" is targeted by every automated brute-force attack. If your account uses "admin": create a new administrator account with a different username, log in as the new user, delete the old "admin" account (reassign posts to the new user). Then use your security plugin's brute-force protection to lock out IPs after 5 failed login attempts.
Automated bots constantly probe /wp-admin and /wp-login.php. Wordfence and Solid Security can limit login page access to specific IP addresses or add a secret key to the login URL (e.g. yourdomain.com/wp-login.php?secret=yourkey). Alternatively, use a WAF (Cloudflare) to block login page access from all IPs except your office/home IP using firewall rules.
A WAF filters malicious traffic before it reaches your server. Cloudflare's free plan includes a basic WAF and DDoS protection. Wordfence Security includes a WordPress-specific WAF that blocks known attack patterns. Cloudflare + Wordfence together provide defence in depth. Cloudflare blocks network-level attacks, Wordfence handles application-level attacks.
Two lines in wp-config.php: `define('DISALLOW_FILE_EDIT', true);` removes the theme/plugin code editor from wp-admin (prevents attackers who gain WP access from injecting code). Block PHP execution in uploads folder by adding a .htaccess in wp-content/uploads/: `<Files *.php>` / `deny from all` / `</Files>`. This blocks a common malware injection technique.
Backups are your last line of defence if prevention fails. Install UpdraftPlus and configure: daily backups, retention of 7 copies, remote storage to Google Drive or Amazon S3 (off your web server. A compromised server backup is useless). Test restoring from backup at least once so you know the process works before you need it under pressure.
Enable Wordfence's email alerts for: admin account creation, login from unknown location, plugin/theme file changes, and failed login spikes. Sign up for a free uptime monitor (UptimeRobot) to detect any defacement or redirects caused by hacking. Review your hosting account's access logs quarterly for unusual patterns.