ParsonsHosting

WordPress how-tos

How do I keep my WordPress site secure and up to date?

By Chris Parsons, founder of ParsonsHosting. Published .

Keep WordPress, your theme and your plugins updated, use strong unique passwords with two-factor login, remove anything you do not use, and keep recent backups. Apply WordPress security updates quickly: WordPress shipped three security releases (7.1.1, 7.1.2 and 7.1.3) in September and October 2026 alone. Every ParsonsHosting site also gets a free Let's Encrypt SSL certificate, and you can set up a staging copy to test updates safely.

Person writing in a planner next to a laptop on a wooden desk

Step 1: Update WordPress core

  1. Log in to your dashboard and go to Dashboard > Updates.
  2. If a new WordPress version is listed, click Update to version x.x.x.
  3. Wait for the success message, then visit your site to check it.

WordPress installs minor security releases automatically on sites that support background updates, but check that you are on the current version (7.1.3 as of mid-October 2026). Other updates are up to you or your developer for now; we plan to offer automatic WordPress updates as an upgrade in the future.

Step 2: Update plugins and themes

  1. Go to Plugins > Installed Plugins.
  2. Update any plugin with an update notice.
  3. Consider clicking Enable auto-updates for plugins you trust and use every day, such as your form and security plugins.
  4. Go to Appearance > Themes and update your theme.

For big updates (a new major WordPress version or a major plugin version on an online store), try them on a staging copy first. When everything works there, update the live site during a quiet time and check your key pages afterward.

How to set up a staging copy

Staging is included on every plan:

  1. WP Toolkit staging: in cPanel, open WP Toolkit and clone your site. It copies the site to a subdomain and can copy your changes back to the live site when you are ready.
  2. Optional: make a copy by hand. If you prefer to do it yourself, in cPanel, add a subdomain such as staging.yourbusiness.com under Domains, copy your site files into it with File Manager, and copy the database with phpMyAdmin. A WordPress copy also needs its settings pointed at the new database and address. We can walk you through it.
  3. On a WordPress staging copy, turn on Discourage search engines from indexing this site under Settings > Reading, so Google does not list the copy.

Step 3: Remove what you do not use

Out-of-date plugins and themes can be a risk even when deactivated.

  1. Delete plugins you are not using.
  2. Keep your active theme plus one default WordPress theme as a fallback; delete the rest.
  3. Remove old user accounts for people who no longer work on the site.

Step 4: Lock down logins

  1. Use a unique, long password for every admin account (a password manager helps).
  2. Turn on two-factor authentication (2FA) with a plugin.
  3. Give people only the role they need: a blog writer can be an Author, not an Administrator.
  4. Give each person their own login.

Step 5: Keep HTTPS and PHP current

  1. Every ParsonsHosting site gets a free Let's Encrypt SSL certificate. Check that your site loads with https:// and the padlock in the browser, and that Settings > General lists both addresses with https://. If your domain's DNS is on Cloudflare, set Cloudflare's SSL/TLS mode to Full (strict). See how to set up email and SSL with Cloudflare DNS.
  2. Check Tools > Site Health for an outdated PHP version. Multiple PHP versions are available. If an older site cannot move to a newer PHP version yet, hardened legacy PHP versions through CloudLinux keep it better protected while you plan the upgrade. Test any PHP change on staging first.

Step 6: Know your backups

ParsonsHosting keeps offsite backups three times a week (Monday, Tuesday and Friday) on every plan.

Still make your own backup before a big change, such as a redesign or a major store update.

Step 7: Watch for warning signs

Contact us if you see admin users you did not create, strange pop-ups or redirects, a browser or Google warning, or spam sent from your domain. Do not delete files at random. Open a support ticket at /submitticket.php; we reply the same day, 8 AM to 5 PM Pacific, 7 days a week.

A simple weekly routine

  1. Log in and check Dashboard > Updates, and apply any updates.
  2. Open your homepage and contact page to confirm they work.
  3. Check Tools > Site Health once a month.

Release news is on wordpress.org/news, and we post notable updates on X at @ParsonsHosting.

Hosting with backups included

See WordPress hosting; migrations are free regardless of size or time. More about us and in the FAQ.

Related guides

See all articles