WordPress is tightening its security focus: what site owners should do.

On 1 September, the WordPress Security Team announced updates to its Vulnerability Disclosure Program. It says the work is intended to concentrate reporting and research on issues with meaningful security impact, alongside investment in the security-release process and proactive vulnerability research.

For a business running WordPress, the important point is not the wording of a reporting programme. It is that security is an ongoing responsibility shared between the software project, hosting provider and the people who maintain the individual website.

The calmest response to a security issue is having the basics already owned: access, backups, updates and a way to check the journeys customers rely on.

Three things worth checking now

1. Know who can act. Keep an up-to-date record of hosting, domain, WordPress administrator and plugin-account access. Remove accounts that are no longer needed.
2. Keep updates deliberate. Core, plugin and theme updates need a routine that accounts for compatibility and business-critical journeys—not simply an unattended list of notifications.
3. Make recovery realistic. Confirm that backups are recent, can be restored and include the parts of the site that matter, such as forms, orders, bookings and content.

Security and website continuity belong together

Urgent updates can be necessary, but an update is only one part of the response. A sensible check also covers the public pages, contact route, checkout or booking flow, and any integrations the business depends on. That turns a technical task into confidence that the site can still do its job.

This is particularly important for inherited WordPress sites, where credentials, plugins and past decisions may be spread between former suppliers. Establishing ownership before an incident gives teams more options and fewer surprises.

Explore WordPress support →