A slow WordPress site loses visitors before they read a word, and a hacked one can lose you customers and search rankings for months. The good news is that most problems come from a short list of fixable causes.
To make WordPress fast and secure, start with good hosting, a current PHP version and a small set of well-maintained plugins. Add page caching, optimised images and a CDN for speed, then protect the site with regular updates, strong logins with two-factor authentication, off-site backups and monitoring.
Why do WordPress sites become slow or vulnerable?
WordPress core is well maintained. Most trouble comes from what is added around it: cheap or overloaded hosting, heavy page builders, too many plugins, large images and updates that are postponed for months. Abandoned plugins are a particular risk because security flaws in them may never be fixed.
WordPress speed checklist
Hosting and server
- Use hosting suited to your traffic, ideally with server-level caching and SSD or NVMe storage.
- Run a PHP version that is still actively supported, and test the site after upgrading.
- Enable an object cache such as Redis if your host supports it, especially for WooCommerce stores.
Caching and delivery
- Install one page caching solution (for example WP Rocket, LiteSpeed Cache or W3 Total Cache), never several at once.
- Serve static files through a CDN such as Cloudflare.
- Enable compression and long cache lifetimes for static assets.
Images and front end
- Resize images before upload and serve modern formats such as WebP or AVIF.
- Lazy-load images below the fold, but not the main hero image.
- Remove unused plugins, fonts and scripts, and avoid loading sliders or chat widgets on every page if they are only needed on one.
- Keep the database tidy by limiting post revisions and clearing expired transients.
Measure the result with Google PageSpeed Insights and the Core Web Vitals report in Search Console. Our guide to Core Web Vitals explains what the scores mean.
WordPress security checklist
Updates and plugins
- Update WordPress core, themes and plugins regularly, testing on a staging site first for larger updates.
- Delete plugins and themes you are not using, rather than just deactivating them.
- Install plugins only from reputable sources and avoid "nulled" (pirated) premium plugins, which often contain malware.
Logins and access
- Use strong, unique passwords and enable two-factor authentication for every administrator.
- Limit login attempts, or put the login page behind a web application firewall.
- Give each person their own account with the lowest role they need. Avoid shared admin logins.
- Disable the built-in file editor by adding
define( 'DISALLOW_FILE_EDIT', true );towp-config.php. - Disable XML-RPC if you do not use apps or services that depend on it.
Protection and recovery
- Serve the whole site over HTTPS.
- Use a firewall and malware scanner, such as Wordfence, Sucuri or your host's equivalent.
- Take automatic daily backups stored off the server (for example with UpdraftPlus to cloud storage), and test a restore occasionally.
- Set up uptime monitoring so you hear about problems before your customers do.
How often should you do each task?
| Task | Suggested frequency | Why it matters |
|---|---|---|
| Plugin, theme and core updates | Weekly or fortnightly | Closes known security holes |
| Backups | Daily, more often for busy stores | Lets you recover from hacks or mistakes |
| Restore test | Quarterly | Confirms backups actually work |
| Speed check | Monthly and after big changes | Catches slow plugins or heavy pages early |
| User and plugin review | Quarterly | Removes old accounts and unused code |
| Security scan | Daily (automated) | Spots malware and suspicious changes |
Do page builders and themes affect speed?
Yes, often more than people expect. Some multipurpose themes and visual page builders load large amounts of CSS and JavaScript on every page, even for features you never use. That does not mean you must avoid them entirely, but it helps to choose carefully:
- Prefer lightweight, well-maintained themes, or the block editor with a theme designed for it.
- If you use a page builder, enable its performance options and avoid stacking several add-on packs.
- Test a typical page on a slow mobile connection, not just the home page on office Wi-Fi.
- When rebuilding, consider whether a simpler theme would meet your needs with less code.
Every extra plugin or add-on is also something else to update, so lighter sites tend to be easier to secure as well as faster.
What should you do if your WordPress site is hacked?
- Put the site into maintenance mode or take it offline to protect visitors.
- Change all passwords, including hosting, database and admin accounts.
- Restore a clean backup from before the infection, or have the site cleaned professionally.
- Update everything and remove the plugin or account that let the attacker in.
- Check Google Search Console for security warnings and request a review once the site is clean.
Prevention is far cheaper than recovery, which is why the checklist above focuses on routine tasks rather than emergency fixes.
For a wider view of security beyond WordPress, see our web application security checklist.
Key takeaways
- Good hosting, few plugins and proper caching solve most WordPress speed problems.
- Regular updates, two-factor logins and off-site backups prevent most security disasters.
- Treat speed and security as routine maintenance, not a one-off project.
If your WordPress site is slow, outdated or has been compromised, we can audit it and fix the causes rather than the symptoms. Get a quote for WordPress development, or read what a good maintenance plan should include.