WordPress security checklist for Malaysian business websites

Most hacked WordPress sites in Malaysia were not targeted. They were found by automated bots scanning millions of sites for one outdated plugin or one weak password. The good news is that the same few habits block the large majority of these attacks.

How business sites actually get compromised

• Outdated plugins and themes. Vulnerabilities are published, and bots start probing within days.
• Nulled premium plugins. "Free" copies of paid themes and page builders downloaded from file-sharing sites often ship with a backdoor already installed.
• Weak or shared admin passwords. One "admin / company123" login shared by the whole office.
• Old staff accounts. A former intern or previous agency still has administrator access.
• Shared hosting cross-infection. Several old sites in one cPanel account, one gets infected, and it spreads to the rest.
• Abandoned plugins. A plugin that has not been updated in years is a risk even if it still works.

Signs your site may already be infected

• Visitors on mobile are redirected to gambling, betting, or adult sites, while the site looks fine on your office computer
• Google shows Japanese or unrelated product titles for your pages
• Search Console reports "Security issues" or a "Deceptive site" warning
• Unknown administrator users, or PHP files in the uploads folder
• Your hosting provider suspends the account for sending spam

The prevention checklist

Updates and plugins

• Update WordPress core, plugins, and themes at least monthly, after testing on staging for business-critical sites
• Remove plugins and themes you do not use. Deactivated plugins can still be exploited.
• Buy premium plugins from the original developer. Never install nulled copies.
• Prefer plugins with recent updates and an active support forum

Accounts and logins

• One named account per person. No shared "admin" login.
• Two-factor authentication for every administrator and shop manager
• Give staff the lowest role that does the job: Editor or Shop Manager, not Administrator
• Remove accounts for former staff and previous agencies the day they leave
• Limit login attempts, and consider changing or protecting the login URL

Hosting and network

• Keep each important site in its own hosting account or container
• Run a supported PHP version
• Put the site behind Cloudflare with the web application firewall and bot protection enabled
• Force HTTPS and keep SSL certificates renewing automatically
• Disable XML-RPC if nothing you use needs it

Backups

• Automatic daily backups of files and database, stored off the server (cloud storage, not the same cPanel)
• Keep at least 30 days of history, because infections are often discovered weeks later
• Test a restore at least twice a year, because backups often fail silently (missing database, corrupted archive, expired storage account)

Monitoring

• Verify the site in Google Search Console and read the security emails
• Use uptime monitoring so you hear about downtime before customers do
• Enable file change alerts from a security plugin or the host

Who needs which access

WooCommerce stores need extra care

• Never store card details on your server; use a payment gateway that handles them on its own pages or fields
• Keep payment gateway plugins on their latest version, because they handle money and personal data
• Watch for fake orders and card-testing attacks; enable bot protection on checkout
• Limit who can export customer lists, and keep exports off shared drives
• Test checkout on staging after every major update before applying it to the live store

A monthly security routine

1. Confirm last night's backup exists and is stored off the server.
2. Apply updates on staging, test key pages and forms, then update the live site.
3. Review the user list and remove anyone who no longer needs access.
4. Check Search Console for security warnings and unusual indexed pages.
5. Check the firewall or security plugin log for repeated attacks on one area.
6. Renewals: domain, SSL (if not automatic), and premium licences that bring security fixes.

This takes an experienced person well under a day per month for a typical business site, and it prevents most incidents.

If your site is already hacked

1. Take a full backup of the current state for investigation, even though it is infected.
2. Change every password: WordPress users, hosting, database, FTP/SFTP, and email.
3. Restore from a clean backup taken before the infection, if you have one.
4. Otherwise, replace WordPress core, plugins, and themes with fresh copies and inspect the uploads folder, wp-config.php, and the database for injected code.
5. Find how they got in (usually an outdated plugin) and fix it, or the site will be reinfected.
6. Request a review in Google Search Console once the site is clean.

What ongoing care costs

Security is mostly routine work: updates, backups, and monitoring every month. That is cheaper than a malware clean-up plus lost enquiries while the site is down or flagged by Google. See website maintenance cost in Malaysia for how maintenance is usually scoped.

Related

• Why your WordPress site is slow, and how to fix it
• WordPress custom development
• Technical SEO checklist before launch