Essentials path · Beginner to improver

Security, Backups and Recovery

Keep your WordPress site safe with a simple routine for updates, logins and backups, and know exactly what to do, in what order, if it is ever hacked.

Who this course is for

This course is for anyone who looks after a WordPress site and wants to stop worrying about it. That might be a small business owner who built their own site and now has a long list of updates they are scared to click. It might be a freelancer who looks after a handful of client sites. Or it might be someone who has already been hacked once and never wants to go through that again.

Most WordPress hacks are not clever. They come through an outdated plugin, a reused password or a backup that turns out not to exist. You do not need to be a developer to fix those things. You need a routine, a few well-chosen settings and a written plan. That is what this course gives you, taught by Shaz, a UK web developer who cleans up hacked sites for real clients.

What you should know first

You need a WordPress site you can log in to as an administrator, and access to your hosting control panel (or the login details to ask your host for it). You should be comfortable finding your way round the WordPress dashboard and installing a plugin. You do not need any coding experience: where we edit a file such as wp-config.php, every line is shown and explained. If you have never built a WordPress site before, start with the Begin2Code Elementor Beginner course, then come back here.

By the end of the course you will be able to

Explain the most common ways WordPress sites are actually compromised, and which of them matter for your site.
Update WordPress core, plugins, themes and PHP safely, using staging and backups instead of hope.
Lock down user accounts with least-privilege roles, strong passwords and two-factor authentication on every admin.
Choose and configure a security plugin and a Cloudflare firewall without slowing your site or locking yourself out.
Harden a site with sensible wp-config.php, file permission and security header settings.
Set up automatic off-site backups and prove they work with a test restore.
Recognise the signs of a hack and follow a calm, ordered clean-up using your own emergency runbook.
Keep any WordPress site healthy with a short monthly maintenance routine.

Your course project

Throughout the course you will secure the website of Fernhill Dog Grooming, a small dog grooming salon run by Priya Shah in Shrewsbury. Priya built her WordPress site herself with Elementor three years ago. It has a Home page, Services and Prices, a Gallery, a Book a Groom page using the Bookly booking plugin, a Contact page using WPForms and a small blog.

Like many real small business sites, it has been left to drift. There are 23 updates waiting, plugins and themes nobody uses any more, PHP 7.4, an old web designer's admin account that was never removed, no two-factor login and no backup that anyone has ever tested.

You will work on the Fernhill practice site from the course downloads, then repeat each step on your own site. By the end you will have a secured, documented site with: safe updates done through staging, unused plugins and themes removed, PHP upgraded, least-privilege user accounts with 2FA on every admin, a configured security plugin and Cloudflare firewall, a hardened wp-config.php, automatic off-site backups you have actually restored, a cleaned copy of a deliberately "hacked" site, an emergency runbook ready for the day you need it and a monthly maintenance checklist.

The course downloads include maintenance and hardening checklists, an emergency runbook template, wp-config.php snippets and the practice "hacked" site. You finish with a practical task on your own site, check it against the published marking guide and unlock your completion certificate.

Curriculum

Module 1: How sites really get hacked, and updates done safely · 8 lessons
- 1.0 Course trailer and how this course works
- 1.1 How WordPress sites actually get hacked
- 1.2 Core, plugin and theme updates without breaking things
- 1.3 Removing what you do not use
- 1.4 PHP versions and your host
- 1.5 Worked example: Tansy and Thistle's inventory and update policy
- 1.6 Module 1 recap
- Module 1 worksheet
- Module 1 check (quiz)
Module 2: Users, logins and two-factor authentication · 6 lessons
- 2.1 User roles and least privilege
- 2.2 Passwords, passkeys and two-factor authentication
- 2.3 Login protection: lockouts, CAPTCHA and XML-RPC
- 2.4 Worked example: Tansy and Thistle's user audit and two-factor login
- 2.5 Module 2 recap
- Module 2 worksheet
- Module 2 check (quiz)
Module 3: Security plugins, firewalls and hardening · 7 lessons
- 3.1 What security plugins do (and do not do)
- 3.2 Setting up a security plugin step by step
- 3.3 A firewall in front of the site with Cloudflare
- 3.4 Hardening wp-config.php, files and headers
- 3.5 Worked example: Tansy and Thistle's security set-up
- 3.6 Module 3 recap
- Module 3 worksheet
- Module 3 check (quiz)
Module 4: Backups you can actually restore · 6 lessons
- 4.1 What a good backup looks like
- 4.2 Setting up automatic off-site backups
- 4.3 Test restoring to staging or LocalWP
- 4.4 Worked example: Tansy and Thistle's backups and a timed test restore
- 4.5 Module 4 recap
- Module 4 worksheet
- Module 4 check (quiz)
Module 5: Recognising a hack and cleaning up · 7 lessons
- 5.1 Signs your site has been hacked
- 5.2 The first hour: contain and assess
- 5.3 Cleaning up step by step
- 5.4 After the clean-up: Google, blocklists and who to tell
- 5.5 Worked example: cleaning up the practice hacked site
- 5.6 Module 5 recap
- Module 5 worksheet
- Module 5 check (quiz)
Module 6: Staying clean: your monthly routine and the practical task · 5 lessons
- 6.1 Your monthly maintenance checklist
- 6.2 The practical task: what to submit and how it is marked
- 6.3 Worked example: Tansy and Thistle's practical task submission
- 6.4 Module 6 recap and what comes next
- Module 6 worksheet
- Module 6 check (quiz)