Website security is an essential part of modern web development, particularly for WordPress and PHP-based websites. A compromised site can lead to data loss, search penalties, spam, downtime and lost customer trust, so security should be built in from the start, not bolted on later.
Security I build in
I’ve spent twenty years building and looking after WordPress, Magento and bespoke PHP sites, and I treat security as part of every job. That means careful code, sensible server set-up and staying on top of new threats, from plugin vulnerabilities to critical PHP issues like PHP2Shell.
WordPress security
WordPress powers a large share of the web, which also makes it a common target for automated attacks. Keeping it secure is a mix of maintenance, server configuration and good habits:
- Keeping WordPress core, themes and plugins up to date
- Removing unused plugins and themes, and choosing well-maintained ones
- Strong passwords, two-factor authentication and limits on login attempts
- Disabling XML-RPC where it isn’t needed, and restricting admin access
- Regular malware scans, uptime monitoring and off-site backups
- HTTPS across the whole site
For custom WordPress development, security also means following WordPress coding standards and sanitising
and escaping everything, using functions such as sanitize_text_field() and esc_html().
PHP application security
Secure PHP development is about preventing the common attacks:
- SQL injection
- Cross-site scripting (XSS) and cross-site request forgery (CSRF)
- Remote code execution and unsafe file uploads
- Session hijacking
I use prepared statements, output escaping, secure session handling and strict validation of incoming data, keep secrets and API keys out of the web root, rate-limit forms and APIs, and set secure HTTP headers, including a properly tested Content Security Policy.
Hosting and server security
A well-configured server stops a lot of trouble before it reaches your site: web application firewalls, automatic OS updates, secure file permissions, daily backups with tested recovery, DDoS protection through Cloudflare or a CDN, and isolated environments for each site. See hosting & servers for more.
Ongoing security maintenance
Security isn’t a one-off job. I keep an eye on suspicious logins and server logs, update dependencies and PHP versions, run vulnerability scans, test backups and review plugins and themes regularly. Find out more about maintenance & support.
If the worst has already happened, take a look at hacked site recovery.
