Keeping your WordPress website secure protects your content, customer information, leads, payments, and other sensitive data.

AcquisitionSuite operates within your WordPress installation, so your site’s overall security depends on how WordPress, your hosting environment, plugins, themes, accounts, and email services are configured.

Follow these best practices to reduce security risks.

1. Keep WordPress Updated

Always use a supported version of WordPress.

Regularly update:

• WordPress core
• AcquisitionSuite
• Other plugins
• Themes
• PHP
• Server software

Security vulnerabilities can be discovered and fixed over time. Running outdated software increases your exposure to known vulnerabilities.

Tip: Enable automatic updates where appropriate, but test major updates on a staging site before applying them to an important production website.

2. Use Strong Administrator Accounts

Use strong, unique passwords for WordPress administrator accounts.

Avoid:

• admin as an administrator username
• Simple or commonly used passwords
• Reusing passwords from other services
• Sharing administrator credentials between team members

Each person who manages the website should have their own WordPress account.

3. Use the Principle of Least Privilege

Only give users the permissions they actually need.

For example:

• Give administrators full access only when necessary.
• Use editor-level access for users managing content.
• Avoid giving administrator privileges to users who don’t need them.

When someone no longer needs access to your website, remove or disable their account.

4. Enable HTTPS

Always use HTTPS on your WordPress website.

HTTPS encrypts communication between visitors and your website and is especially important when your website:

• Collects personal information
• Collects passwords
• Processes payments
• Captures leads
• Sends users to account or download pages

AcquisitionSuite requires HTTPS when accepting payments.

Make sure your SSL/TLS certificate is valid and properly configured.

5. Secure Your Hosting Account

Your WordPress security is also affected by your hosting environment.

Use a reputable hosting provider and secure your hosting account with:

• A strong unique password
• Two-factor authentication where available
• Restricted access to hosting control panels
• Secure SFTP instead of unsecured FTP
• Current PHP and server software

Avoid sharing hosting credentials unnecessarily.

6. Keep Plugins and Themes to a Minimum

Only install plugins and themes that you actually need.

Remove plugins and themes that are:

• Unused
• Abandoned
• No longer maintained
• Downloaded from untrusted sources
• No longer required

Do not install pirated or modified versions of premium plugins or themes.

These can contain malicious code or other security vulnerabilities.

7. Use Trusted Plugin Sources

Download AcquisitionSuite and other WordPress plugins from their official sources.

Avoid downloading WordPress plugins from unknown websites, unofficial file-sharing platforms, or modified-plugin repositories.

Before installing a plugin, consider:

• Who developed it
• Whether it is actively maintained
• Whether it receives security updates
• Its compatibility with your WordPress version
• Whether it has a trustworthy support history

8. Protect Your WordPress Database

Your WordPress database contains important website information, including users, settings, content, and plugin data.

Use a unique database password and restrict database access to trusted systems.

Do not expose database credentials publicly or place them in publicly accessible files.

Your hosting environment should also prevent unauthorized remote database access unless it is specifically required.

9. Configure Backups

Maintain regular backups of your website.

A useful backup strategy should include:

• WordPress files
• Database
• Uploaded files
• Plugin and theme configuration

Keep backups separate from the main website where possible.

Most importantly, test your backups.

A backup that has never been restored is not a verified recovery strategy.

10. Secure Downloadable Files

If you use AcquisitionSuite to distribute downloadable resources, pay attention to how those files are accessed.

For sensitive or paid resources:

• Use AcquisitionSuite’s protected download functionality.
• Avoid exposing private file URLs unnecessarily.
• Use appropriate download expiry settings.
• Use download limits where appropriate.
• Do not place sensitive files in publicly accessible locations without access controls.

For paid downloads, configure reasonable expiration and download limits based on your business requirements.

11. Protect Payment Information

If you sell digital downloads through AcquisitionSuite, use trusted payment gateways and configure them correctly.

Never store customers’ full payment card information in WordPress or AcquisitionSuite unless a payment provider explicitly supports and requires such storage.

Whenever possible, let the payment gateway handle sensitive payment information.

Always use HTTPS for payment-related pages.

12. Secure Email Delivery

Configure your website’s email delivery properly.

For reliable and secure email delivery:

• Use a reputable SMTP or transactional email provider.
• Use an email address from a domain you control.
• Configure SPF.
• Configure DKIM.
• Configure DMARC where appropriate.
• Avoid using personal email accounts as your website’s sender address.

For AcquisitionSuite, configure your sender details under:

AcquisitionSuite → Settings → Email: Delivery

13. Use Two-Factor Authentication

Enable two-factor authentication for administrator accounts whenever your WordPress security setup supports it.

2FA provides an additional layer of protection if a password is compromised.

It is particularly important for:

• Administrators
• Site owners
• Users with access to customer information
• Users who can install or modify plugins

14. Protect Your Login Page

Your WordPress login page is a common target for automated attacks.

Consider using security measures such as:

• Login rate limiting
• Brute-force protection
• Two-factor authentication
• Strong passwords
• CAPTCHA or bot protection where appropriate

Do not rely solely on changing the default login URL as your primary security measure.

15. Limit Administrator Access

Review your administrator accounts regularly.

Remove accounts that are no longer needed and review the permissions of existing users.

For agencies or teams, avoid giving every team member administrator access simply because it is convenient.

More privileges mean more potential impact if an account is compromised.

16. Protect Sensitive Configuration Files

Never expose sensitive configuration files publicly.

Your WordPress configuration can contain database credentials and other sensitive information.

Do not publish or share:

• wp-config.php
• API keys
• Database credentials
• SMTP passwords
• Payment gateway secret keys
• License or service credentials
• Private access tokens

Store credentials securely and never commit them to public repositories.

17. Use Security and Monitoring Tools

Consider using a reputable WordPress security solution to help monitor your website.

Security tools can provide features such as:

• Malware scanning
• Login protection
• Firewall protection
• File-change monitoring
• Vulnerability detection
• Security alerts

However, a security plugin should complement — not replace — good WordPress administration practices.

18. Monitor Your Website

Regularly review your website for unusual activity.

Look for:

• Unknown administrator accounts
• Unexpected plugin installations
• Unrecognized file changes
• Suspicious login attempts
• Unexpected redirects
• Unusual email activity
• Unexpected payment activity
• Unexplained changes to website content

Investigate suspicious activity promptly.

19. Use a Staging Environment

For important websites, consider maintaining a staging environment.

Use staging to test:

• WordPress updates
• Plugin updates
• Theme changes
• PHP upgrades
• Major configuration changes

After confirming that everything works correctly, apply the changes to your production website.

20. Have an Incident Recovery Plan

Security is not only about preventing attacks. You should also be prepared to recover from one.

Have a plan for:

1. Identifying the affected website or account.
2. Restricting access if necessary.
3. Preserving relevant logs and evidence.
4. Restoring from a known-clean backup.
5. Changing compromised credentials.
6. Updating vulnerable software.
7. Checking administrator accounts and website files.
8. Reviewing payment and customer activity.
9. Monitoring the website after recovery.

If sensitive customer or payment information may have been exposed, follow the applicable legal and regulatory requirements for your location and business.

AcquisitionSuite Security Checklist

Before launching an AcquisitionSuite website, verify the following:

• WordPress is up to date
• AcquisitionSuite is up to date
• All plugins and themes are from trusted sources
• Unused plugins and themes have been removed
• HTTPS is enabled
• Administrator accounts use strong unique passwords
• Two-factor authentication is enabled where available
• Users have only the permissions they need
• Regular backups are configured
• Backups have been tested
• Email delivery is properly configured
• Payment gateways are configured securely
• Downloadable resources have appropriate access controls
• Sensitive credentials are not publicly exposed
• Security monitoring is enabled where appropriate

Important

AcquisitionSuite can help you manage lead capture, forms, downloads, and payments, but no WordPress plugin can secure your entire website by itself.

Your hosting provider, WordPress configuration, other plugins, themes, administrator accounts, passwords, payment providers, and operational practices all contribute to your website’s security.

Keep your entire WordPress environment updated, minimize unnecessary access, maintain tested backups, and investigate security warnings promptly.