- AEO QUICK ANSWER
WordPress 7.1 Update Guide for UK Businesses
If you run a business website on WordPress, 2026 has been the busiest year for the platform since block editing arrived. WordPress 7.0 shipped in May with AI infrastructure built into core and a redesigned admin. WordPress 7.1 followed in August. The 7.1.1 maintenance release lands this week, and 7.2 is already scheduled for December.
That is four significant updates in one year for a site that most owners would rather not think about at all.
This guide explains what actually changed, what is likely to break on a typical UK business site, and how to update without losing a morning of trading. It is written for business owners and agency teams, not core contributors, so we will stay away from the developer detail unless it affects a decision you need to make.
This snippet is structured to appear in AI search results including ChatGPT, Perplexity and Google AI Overviews.
- IN THIS ARTICLE
WordPress runs more than 43 per cent of the web, according to the WordPress project’s own figures, and that share is exactly why it is attacked more than any other platform. Not because it is weak, but because it is everywhere, and because the typical business site runs two dozen plugins written by two dozen different authors.
Most breaches are not clever. They are an old plugin, a reused password, or a backup nobody tested. This checklist covers the 25 checks that close those doors, ordered by how much risk each one removes, with the UK legal context that increasingly makes security a compliance matter rather than a technical preference.
What is WordPress maintenance?
A WordPress security checklist is a structured list of configuration, maintenance and monitoring controls that reduce the chance of a site being compromised and limit the damage if it is. A good one covers five layers: software (core, themes, plugins), access (users, passwords, logins), hosting and server, backups and recovery, and monitoring. Treat it as a quarterly audit rather than a one-off.
How much does WordPress maintenance cost in the UK in 2026?
Three things changed.
WordPress 7.0 introduced the AI Client and expanded the Abilities API, which means plugins can now let external tools and AI agents act on your site. The permissions model handles this well, but only if user roles are set correctly. A contributor account with a weak password used to be a nuisance. Connected to an automation tool, it is a bigger problem.
The UK regulatory picture tightened. The Data (Use and Access) Act 2025 raised the maximum fines under PECR to the same level as UK GDPR, and the Cyber Security and Resilience Bill, introduced to Parliament in late 2025, is extending security obligations to more organisations and their suppliers. A hacked site that leaks customer data is now a reportable incident with a regulator attached.
And attackers automated. Vulnerability disclosures for popular plugins are exploited within hours, at scale, by scripts that scan every WordPress site on the internet. The window between “patch released” and “site attacked” has closed to almost nothing.
- Stay visible across Google and AI search. WP Miracle blends SEO and AEO into one strategy.
The checklist: software (checks 1 to 6)
1. WordPress core is on the current release. As of this week that means 7.1.1. Older branches receive security fixes for a limited time only.
2. PHP is 8.2 or 8.3. WordPress 7.0 dropped PHP 7.2 and 7.3. PHP 7.4 has had no security updates since 2022. Check your hosting panel.
3. Every plugin was updated in the last 12 months. Plugins abandoned by their authors do not get patched when vulnerabilities are found. Replace them.
4. Unused plugins and themes are deleted, not just deactivated. Deactivated code can still be exploited through direct file access. Keep one default theme as a fallback and remove the rest.
5. Plugins are sourced only from WordPress.org or the developer’s own site. Nulled or “free premium” plugins routinely ship with backdoors.
6. Plugin count is under control. There is no magic number, but every plugin is a maintained dependency. If two plugins do the same job, remove one.
Patchstack, which tracks WordPress vulnerabilities, has reported year after year that the vast majority of disclosed WordPress vulnerabilities are in plugins rather than core. The software layer is where most of your risk lives.
## The checklist: access (checks 7 to 13)
7. No user is called “admin”. Attackers try it first. Create a new administrator, transfer content, delete the old one.
8. Every account has a unique, long password. Twelve characters minimum, generated by a password manager, never reused from another service.
9. Two-factor authentication is enforced for administrators and editors. Wordfence includes 2FA in its free tier. This single check stops most credential-based attacks.
10. Login attempts are limited. Five failures then a lockout. Again, Wordfence handles this.
11. Users have the lowest role that lets them do their job. Most people who “need admin” need editor. Audit the users list every quarter and remove anyone who has left.
12. XML-RPC is disabled unless something needs it. It is a legacy interface used for brute force amplification. Jetpack and some mobile apps use it; if you do not, turn it off.
13. Application passwords and API keys are reviewed. WordPress 7.0’s AI connectors and the Abilities API use REST authentication. Every stored key is a credential. Know what each one is for and revoke the ones you cannot explain.
The checklist: hosting and server (checks 14 to 18)
14. The site is on HTTPS with a valid certificate and HTTP redirects to HTTPS. Basic, and still missed on subdomains and old landing pages.
15. A web application firewall is active. Either at the host or CDN level (Cloudflare, SiteGround’s built-in WAF) or via Wordfence at the application level. Ideally both.
16. File editing is disabled in the admin. Add define('DISALLOW_FILE_EDIT', true); to wp-config.php. It removes the theme and plugin editors, which are the first thing an attacker uses after gaining admin access.
17. File permissions are correct. Directories 755, files 644, wp-config.php 600 or 640. Anything world-writable is a problem.
18. Directory listing is off and sensitive files are blocked. wp-config.php, .htaccess, readme.html and debug.log should not be readable from a browser. A managed host usually handles this; check anyway.
The checklist: backups and recovery (checks 19 to 21)
19. Backups run daily and are stored off the hosting account. If the host is compromised or suspends the account, a backup on the same server is gone too. UpdraftPlus to Google Drive, Dropbox or S3 is the common free setup.
20. Backups are retained for at least 30 days. Malware often sits undetected for weeks. A seven-day retention can mean every backup is infected.
21. A restore has been tested in the last six months. This is the check most sites fail. A backup you have never restored is untested software. Restore to staging and confirm the site loads.
The checklist: monitoring (checks 22 to 25)
22. Malware scanning runs on a schedule. Wordfence scans compare core files against WordPress.org and flag modifications. Weekly minimum.
23. Uptime monitoring alerts a human. A free tool like UptimeRobot checking every five minutes is enough. The point is finding out before your customers do.
24. Someone reads the security logs. Failed logins from unusual countries, new admin users, file changes. Wordfence emails a summary. Read it.
25. There is a written incident plan. Who is called, where the backups are, who has hosting access, and who talks to customers. One page. Written before it is needed.
What are the most common WordPress attacks in 2026?
Knowing the attack explains the control.
Plugin vulnerability exploitation. An attacker scans for a plugin with a known flaw and uses it to upload a backdoor. Controls: checks 1 to 6.
Credential stuffing. Passwords leaked from another service are tried against wp-login.php. Controls: 8, 9, 10.
Pharma and SEO spam injection. The site is modified to serve spam links or redirect visitors, usually invisible to the owner and very visible to Google. Controls: 22, 24, and a good backup to restore from.
Cross-site contamination. One compromised site on a shared hosting account infects the others. Control: isolate sites, one per account where possible.
Supply chain. A legitimate plugin is sold to a new owner who ships malicious code in an update. Rare but rising. Control: watch changelogs and ownership changes on critical plugins.
How does UK law affect WordPress security?
Three pieces of legislation matter for a UK business running WordPress in 2026.
UK GDPR requires “appropriate technical and organisational measures” to protect personal data. A contact form submission is personal data. An unpatched site that leaks it is a breach that may need reporting to the ICO within 72 hours.
PECR governs marketing communications and cookies. The Data (Use and Access) Act 2025 aligned PECR fines with UK GDPR, so a compromised site sending spam from your domain is now a more expensive problem.
The Cyber Security and Resilience Bill, working through Parliament since late 2025, expands the scope of organisations with formal cyber obligations and puts more weight on supply chain security. If you supply larger organisations, expect security questionnaires that ask about exactly the checks above.
None of this requires perfection. It requires evidence that you took reasonable steps. A dated checklist is that evidence.
How much does a WordPress breach cost a UK business?
UK sources put the direct cost of recovering a compromised small business website at £500 to £1,500 for clean-up alone. That excludes lost sales during downtime, the SEO damage from being flagged by Google Safe Browsing (which can take weeks to clear), and the reputational cost of customers seeing a hacked site.
Against that, the controls above cost almost nothing. Wordfence and UpdraftPlus are free. Two-factor authentication is free. A managed care plan that does all 25 checks for you starts at £79 a month.
How do you actually run this checklist?
Set aside 90 minutes for a first pass on a typical business site. Go through the five layers in order, because the software layer is where most failures are and fixing it first often resolves issues further down.
Record the result of each check as pass, fail or not applicable, with a date. A spreadsheet is fine. The record matters more than the format: it is what you show a client, an insurer or the ICO if asked what steps you took.
Fix the fails in this priority: anything in software and access first (checks 1 to 13), because these are exploited actively and automatically; then backups (19 to 21), because they are your recovery route if something is already wrong; then hosting and monitoring.
Repeat the full checklist twice a year and the access review quarterly. Between passes, weekly updates and a scheduled scan carry the load.
If a check fails and you do not know how to fix it, that is the point at which to involve a specialist rather than to skip it. Skipped checks are where breaches start.
Do you need a security plugin if your host is secure?
Yes. Managed hosts secure the server. They do not update your plugins, enforce 2FA on your users, or notice that a contributor account was created at 3am. Host-level security and application-level security cover different layers and both are needed.
The exception is duplication: if your host provides a firewall and malware scanning, you do not need a second firewall plugin doing the same thing. Use the plugin for what the host does not cover, typically login protection, 2FA and file integrity checks.
How WPMiracle handles security on managed sites
Every site on a WPMiracle care plan gets Wordfence and UpdraftPlus configured on onboarding, weekly human-reviewed updates, off-site backups with 30-day retention, login hardening and 2FA for admin users, uptime monitoring, and malware removal included in the plan rather than charged as an emergency. The 25 checks above are our onboarding audit. If you would like it run on your site before deciding anything, request a free audit from the Maintenance Plans page.
FAQS
1. Is WordPress secure in 2026?
WordPress core is secure and maintained by a dedicated security team. Almost all compromises come from outdated plugins, weak credentials and poor hosting configuration, all of which are within the site owner’s control.
2. What is the single most important WordPress security step?
Keeping plugins updated, closely followed by two-factor authentication on administrator accounts. Those two controls address the majority of real-world breaches.
3. Is Wordfence free enough for a business site?
For most small business sites, yes. The free tier includes the firewall, malware scanner, login protection and 2FA. The paid tier adds real-time firewall rule updates, which matters for high-value or high-traffic sites.
4. How often should I check WordPress security?
Updates weekly, user and access review quarterly, a full checklist audit twice a year, and a restore test at least every six months.
5. Does a WordPress hack have to be reported to the ICO?
If personal data was or may have been accessed, and the breach poses a risk to individuals, yes, within 72 hours. If you are unsure whether data was accessed, that uncertainty is itself a reason to seek advice quickly.
