Optimising and securing WordPress sites

Speed and security, one and the same fight.

A slow site and a vulnerable site often share the same origin: too many plugins, an overweight theme, components never updated and a badly configured server. Every plugin adds code to load and a potential way in. According to Patchstack, more than 90 % of WordPress vulnerabilities come from plugins rather than from the core.

The best security plugin is the one you do not need.

Performance: what Google measures.

Google assesses the real experience of visitors through the Core Web Vitals. They influence search visibility and, above all, the conversion rate: a visitor kept waiting is a visitor who leaves.

What we optimise.

• Plugins

  Removing unnecessary or overlapping plugins, and replacing the heaviest with targeted code.

• Theme and scripts

  Loading scripts and styles only where they are used, and removing page builder code where possible.

• Images and fonts

  Modern formats, appropriate dimensions, lazy loading and fonts hosted locally.

• Caching and server

  Page caching, compression and headers handled at server level, which is faster than a PHP plugin.

• Database

  Clearing out revisions, orphan options and temporary data that weigh on every query.

• Continuous measurement

  Core Web Vitals tracked after optimisation, so any regression after an update is spotted.

Security: closing doors, not merely watching them.

• Updates under control

  Core, theme and plugins updated regularly, after checks on a test environment.

• Protected access

  Two-factor authentication, named accounts, minimal rights and limits on login attempts.

• Hardening

  File editing disabled in the admin area, unnecessary entry points blocked, HTTP security headers.

• Server protection

  Firewall, rules at web server level, and isolation of sites on the hosting.

• Off-site backups

  Daily backups stored away from the server, with restores tested.

• Monitoring

  Uptime and file integrity checks, with alerts when something looks wrong.

// wp-config.php
define( 'DISALLOW_FILE_EDIT', true );
define( 'WP_AUTO_UPDATE_CORE', 'minor' );

# Nginx: block an unused entry point
location = /xmlrpc.php { deny all; }

Has your site been hacked?

1. 01

   Isolate

   Taking the site offline or into maintenance if needed, and changing access immediately, to stop the damage.

2. 02

   Analyse

   Identifying the way in: a vulnerable plugin, a compromised password, a modified file, an account created without your knowledge.

3. 03

   Clean or restore

   Removing the malicious code or restoring a healthy backup, then checking the files and the database in full.

4. 04

   Close the weakness

   Updating or replacing the vulnerable component, and hardening access and the server.

5. 05

   Restore trust

   Requesting a review from Google if the site has been flagged, checking Search Console and stepping up monitoring.

With an eye on what comes next.

Optimising and securing an existing site is often the first step. When the foundation is too fragile, a bespoke rebuild becomes a better investment than one correction after another. And so the work does not unravel over the months, our Care service takes over: updates, backups and continuous monitoring.