If you run a business in Bydgoszcz and have a WordPress website or shop, WordPress site security is not a subject for corporations. Attacks are largely automated: bots scan the whole internet for known holes and do not care whether a site belongs to a salon in Śródmieście or a large company. A small business is therefore just as much “in the crosshairs” as a large one, and usually less well protected.
This guide shows what you risk and what to do: from updates and backups, through hardening the configuration, to a plan in case of a break-in. We do not promise “100% security”, because it does not exist; the goal is an attack that is hard, quickly detected and harmless in its consequences. If you prefer to start with a diagnosis, use the free WordPress security test.
What you risk when a Bydgoszcz company website is hacked
A break-in is rarely a defaced home page; more often the attacker quietly uses your site for their own purposes. Typical consequences:
- SEO spam and redirects – hidden links or subpages advertising other people’s services, while visitors from Google land on foreign sites.
- Malware – browsers or Google may warn visitors before entering the site, which cuts you off from customers.
- Data leaks – form enquiries, customer accounts, shop orders.
- Downtime – for a shop, every hour of unavailability means lost orders.
The most common attack vectors on WordPress sites
Outdated plugins and themes
This is the most common cause of break-ins. When a vulnerability is found in a plugin, the author publishes a fix, and information about the hole becomes public. From that moment bots look for sites that have not yet installed the update. A plugin abandoned by its author is particularly dangerous.
Nulled and pirated plugins
A “free” version of a paid theme or plugin from an unofficial site very often contains a hidden backdoor. The rule is simple: we download plugins and themes only from the WordPress.org directory or directly from the author, with a valid licence.
Weak passwords and no 2FA
Reused passwords, the login “admin” and accounts of former colleagues are a straight path to taking over the panel. Two-factor authentication (2FA) makes this significantly harder.
Brute force on wp-login and XML-RPC
Bots constantly try to guess passwords on the login page and through the xmlrpc.php file, which allows many passwords to be tested in one request. If you do not need it, disable or restrict it, and put a limit on login attempts.
Vulnerable forms and uploads
Every place where a user can send something (a contact form, file uploads, comments) must validate data and file types. A sloppy upload is a classic route for uploading a malicious script. In custom WordPress plugins, data validation is fundamental.
Updates and plugin policy
The most effective protection is boring: regular updates. Set a rhythm, e.g. a weekly review, and install security fixes faster. Try larger changes on staging first.
- The fewer plugins, the smaller the attack surface. Remove everything you do not use (do not just deactivate it).
- Check the source – date of the last update, compatibility with the current WordPress version, number of active installations, reliable handling of support requests.
- Plan the replacement of abandoned add-ons – when a plugin is no longer developed, replace it.
Watch the PHP version too: older ones no longer get fixes. When tidying plugins, see the guide to WordPress site speed: fewer add-ons mean a faster and safer site.
Hardening: tightening the WordPress configuration
Hardening is a set of settings that reduce the attacker’s chances even when a vulnerability appears somewhere.
Settings in WordPress
- Disable the file editor in the panel – the
DISALLOW_FILE_EDITconstant inwp-config.phpprevents editing theme and plugin code from the panel. - Limit the number of administrators – most people need an editor or author role. The principle of least privilege saves trouble.
- Hide the WordPress version – there is no reason to tell bots which version you use.
Server and file permissions
Typically directories should have 755 permissions, files 644, and the wp-config.php file even more restrictive ones (e.g. 600 or 640, depending on the server configuration). It is worth blocking PHP execution in the uploads directory and disabling directory listing. Values depend on the hosting.
Security headers, HTTPS and HSTS
An SSL certificate and redirecting the whole site to HTTPS is today an absolute minimum. The next step is the HSTS header, which tells the browser to always connect to the site over an encrypted connection. It is also worth setting the headers X-Content-Type-Options, X-Frame-Options (or an appropriate rule in Content-Security-Policy) and Referrer-Policy. You will find general guidance in the official WordPress documentation.
Backups: the 3-2-1 rule and a restore test
A backup is your last line of defence. The 3-2-1 rule works well:
- 3 copies of data (production plus two copies),
- on 2 different media or in two different services,
- with 1 copy off the server the site runs on.
A copy on the same hosting account will not protect you against an account takeover. Keep several points in time, because the latest copy may already be “infected”.
The most often skipped step is the restore test. A backup you have never restored is only an assumption. Check once on staging whether a full site with its database and files starts from the backup.
WAF, rate limiting, monitoring and logs
A web application firewall (WAF) filters traffic before it reaches WordPress: it blocks known attack patterns and malicious bots. It works in front of the server (e.g. in a CDN) or as a plugin. It is complemented by rate limiting, that is, a limit on requests and login attempts from one address in a given time, which weakens brute force.
An attack you do not know about lasts longer. Set up:
- uptime monitoring – a notification when the site stops responding,
- file change monitoring – an alert when an unexpected change appears in the WordPress files,
- logs of logins and administrator actions – they let you establish who did what and when,
- Google Search Console – informs you, among other things, about detected security problems.
Hosting and the staging environment
Hosting affects security more than it seems. Pay attention to account isolation, current PHP versions, automatic backups, access via SFTP/SSH instead of plain FTP, and 2FA in the panel. The quality of the service and the speed of technical support response count.
The second pillar is staging, a copy of the site for testing. Updates, new plugins and code changes are checked there first.
WooCommerce shop and payment security
A shop adds new risk vectors: customer accounts, order data and payment gateways. Good practices:
- Do not store card data. Payments should be handled by an external gateway (e.g. Przelewy24, Stripe, BLIK). In our WooCommerce projects we do not store card data on the client’s site.
- Check payment and shipping plugins – update them particularly carefully, on staging first.
- Protect customer accounts – a login attempt limit, strong passwords, bot protection at registration and in the basket.
We write more about running a shop in the article on using WooCommerce in online shops, and you can check your own shop’s health in the free shop health test.
GDPR (RODO) and personal data breaches
If you collect personal data on the site (forms, orders, bookings, a newsletter), a break-in may mean a personal data breach. The data controller should, as a rule, report it to the supervisory authority (in Poland this is the Urząd Ochrony Danych Osobowych, UODO – the Personal Data Protection Office) without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to the rights and freedoms of the people concerned.
This is a general outline; in the event of an incident, consult a data protection officer or a lawyer. You will find official information on the website of the Urząd Ochrony Danych Osobowych (UODO, the Polish data protection authority). You can check the current compliance state of your site (cookies, privacy policy) in the GDPR and cookies test.
What to do after a break-in: a step-by-step plan
- Secure the evidence. Make a copy of the current state (files, database, logs).
- Isolate the site. Enable maintenance mode or temporarily take it offline if it is spreading malicious content.
- Change all passwords: the WordPress panel, hosting, database, FTP/SFTP, email, API keys and the keys (salts) in
wp-config.php. - Find the entry point and the effects. Check for new users, changed files, unknown plugins and cron tasks. Removing the symptom alone is not enough.
- Restore a clean copy or rebuild the site, installing the core, theme and plugins anew from official sources.
- Patch the cause – updates, removing the vulnerable plugin, strengthening access.
- Assess the consequences for personal data and decide on notification in line with GDPR (see above).
- Report the problem in Google Search Console if the site was flagged as dangerous, and monitor it over the following weeks.
Risk, consequence, prevention: a table
| Risk | Consequence | How to prevent |
|---|---|---|
| Outdated plugins and themes | Site takeover through a known vulnerability | Regular updates, removing unused add-ons, staging |
| Nulled / pirated plugins | Hidden backdoor, spam, data theft | Official sources only and valid licences |
| Weak passwords, no 2FA | Administrator account takeover | Password manager, 2FA, minimum privileges |
| Brute force (wp-login, XML-RPC) | Server load, password guessed | Attempt limit, rate limiting, disabling XML-RPC |
| Vulnerable forms and uploads | A malicious script uploaded | Validation, restricting file types, blocking PHP in uploads |
| No backups | Loss of the site or orders | The 3-2-1 rule and a restore test |
10 steps to start with
- Update WordPress, the theme and plugins, and remove the unused ones.
- Remove plugins from unofficial sources.
- Enable 2FA and unique, long passwords for all administrators.
- Limit the number of administrator accounts and delete accounts of former colleagues.
- Enable HTTPS across the whole site and HSTS.
- Add
DISALLOW_FILE_EDITand check file permissions. - Limit login attempts and block or restrict XML-RPC.
- Set up automatic 3-2-1 backups and test a restore once.
- Enable uptime and file change monitoring.
- Write down a simple response plan: who does what, and in what order, after an incident.
To find the gaps, run the free WordPress security test. A broader picture (SEO, security, GDPR, performance, accessibility, AI readiness) comes from the Full Website Audit for 150 PLN, with results in a few minutes and a prioritised list of actions.
Frequently asked questions
Can my small company website in Bydgoszcz really be attacked?
Yes. Most attacks are automated and do not choose targets by company size. Bots look for known vulnerabilities, so any site with outdated add-ons or weak passwords is at risk.
Is one security plugin enough?
No. A security plugin helps (firewall, scanning, login limits), but it will not replace updates, strong passwords, backups and good server configuration.
How often should I make backups?
It depends on how often the site changes. A brochure site can be backed up e.g. once a day, while a shop with live orders needs more frequent database backups.
Do I have to report a break-in to UODO?
It depends on the circumstances. If a personal data breach occurred that poses a risk to the rights or freedoms of individuals, the notification should as a rule be sent without undue delay and, where feasible, within 72 hours. It is worth discussing the situation with a data protection officer or a lawyer.
How much does securing a WordPress site cost?
The cost depends on the size of the site, the hosting and the scope of work, so we do not give a single figure. To start, you can use the free test or the Full Website Audit for 150 PLN, and after a first, free conversation we prepare a fixed-price quote.
Secure your site with us in Bydgoszcz
Not sure how well protected your site or shop is? Book a free conversation (30–60 minutes). After it we will prepare a fixed-price quote, and the first month of support after launch (updates, monitoring) is included in the price. See our services and case studies, write via the contact form or get in touch directly:
Kreatywna Agencja (Canpol Bis Sp. z o.o.)
ul. Gimnazjalna 2/M501, 85-007 Bydgoszcz
tel. +48 502 811 949
e-mail: biuro@kreatywnaagencja.com.pl
kreatywnaagencja.com.pl
