WordPress form and plugin security is not a one-time setup. It is a repeating set of checks that stops spam, reduces attack surface, and keeps your business website working correctly for legitimate visitors.
If you run a contact form, a quote request, a booking widget, or any plugin that accepts visitor input, those entry points need active maintenance. Outdated plugins, missing spam controls, and unverified email sending are some of the most common ways small business WordPress sites become a problem rather than a business tool.
This checklist walks through the practical steps N. Cristea uses when reviewing a WordPress site for form and plugin security. You can work through it yourself or use it as a baseline for understanding what a technical review should cover.
Why WordPress forms and plugins need specific security attention
Forms accept input from anyone on the internet. That makes them a primary target for automated spam bots, credential stuffing attempts, and injection attacks. Plugins extend WordPress functionality, but each plugin is also a potential vulnerability if it is not maintained, uses insecure code, or is abandoned by its developer.
The OWASP Automated Threats to Web Applications documentation identifies multiple threat events that target form interfaces directly, including credential stuffing, scraping, and command injection. For a small UK business, the practical risk is less about sophisticated attacks and more about automated tools scanning thousands of sites per minute looking for weak points.
WordPress powers a significant portion of small business websites in the UK. That popularity makes it a constant target for automated threats. A plugin with a known vulnerability can be exploited within hours of that vulnerability becoming public.
Keep WordPress core, themes, and plugins updated
Running outdated software is the single most common security gap on small business WordPress sites. Plugin and theme developers release updates to fix bugs, patch security issues, and maintain compatibility with the current WordPress version.
A practical update process looks like this:
- Update WordPress core first: Always update the WordPress version before touching plugins or themes. Core updates often include security patches that plugins depend on.
- Update plugins one at a time or in small groups: Updating five plugins at once makes it hard to identify which one caused a problem if something breaks.
- Test after each update: Check that the form still submits, data reaches the correct inbox, and no error messages appear in the admin area.
- Update themes last: Theme updates can affect the layout and functionality of plugin output, including form styling.
For sites that cannot afford downtime during updates, a staging environment lets you test changes before applying them to the live site. How to update WordPress without breaking a business website covers staging setup and rollback planning in more detail.
Identify and remove abandoned plugins
An abandoned plugin is one that has not received an update in over twelve months, or one whose developer has explicitly discontinued it. Abandoned plugins are a security risk because known vulnerabilities stop getting patched.
To check if a plugin is actively maintained, look in the WordPress plugin directory. The last updated date and the compatible version information tell you whether the author is keeping pace with WordPress core changes. A plugin that has not been updated in two years and claims compatibility with WordPress 4.x is almost certainly incompatible with current versions.
If a plugin you need has been abandoned, look for an actively maintained alternative. If no good replacement exists, consider whether the function it provides is worth the maintenance risk. Sometimes the safest answer is to remove the plugin and handle that task differently, at least until a reliable replacement appears.
Add and verify form spam controls
Form spam is not just annoying. A high volume of spam submissions can fill your database, obscure genuine enquiries, and sometimes indicate that someone is probing your form for injection vulnerabilities.
Effective spam control usually combines two or three of these approaches:
- CAPTCHA or reCAPTCHA: Google reCAPTCHA v2 or v3 adds a challenge layer that most bots cannot pass. v3 runs in the background and scores submissions. v2 shows a checkbox or image challenge. Both significantly reduce bot submissions.
- Honeypot fields: A hidden form field that real users never see but bots do fill in. If the hidden field has a value, the submission is rejected. This adds no friction for humans and stops most basic bots.
- Timestamp checks: Record the time when the form loads. If it is submitted in under three seconds, it is almost certainly a bot. Legitimate visitors take longer to read and type.
- Question-based challenges: Simple questions like "What is two plus three?" stop most automated tools without annoying real users.
Most WordPress form plugins include built-in spam protection settings. Check that these are enabled and test them periodically to confirm they are still working.
Test your email sending configuration
Forms that do not send email are a common problem N. Cristea encounters during site reviews. WordPress sends email using the PHP mail function by default, which many hosting providers now block or filter aggressively because it is commonly abused by spam senders.
If your contact form submissions are not reaching your inbox, the most reliable fix is to configure SMTP sending. This routes email through properly authenticated servers rather than the default PHP method.
A basic SMTP setup includes:
- An email account created specifically for your website, not your main business address
- SMTP credentials from your hosting provider or email service
- A plugin such as WP Mail SMTP or a similar well-maintained option that intercepts WordPress mail and sends it via SMTP
- Testing by submitting a form and checking both the inbox and spam folder
After configuring SMTP, test regularly. Email deliverability can degrade over time as IP reputations change or hosting configurations update.
Verify CSRF protection and nonce usage in custom forms
Cross-Site Request Forgery (CSRF) is a threat where a malicious page tricks a logged-in user into submitting an unintended request to your site. WordPress provides a built-in mechanism to prevent this: nonces. A nonce is a unique token generated for each form and verified when the form is submitted.
If you are using a well-maintained form plugin, CSRF protection is usually handled automatically. The plugin generates the nonce when the form loads and validates it when the form is submitted.
For custom-built forms or form handlers, you need to add nonce verification manually. The WordPress function wp_verify_nonce() checks that the submitted token matches the one generated for that session.
When reviewing plugin code, check that form handlers include wp_verify_nonce() or equivalent validation. Forms without this check are vulnerable to CSRF attacks, though exploiting them typically requires the target to be logged in and tricked into visiting a malicious page.
The WordPress plugin handbook security section provides detailed guidance on nonce implementation and other plugin security practices that are worth reviewing if you commission custom development.
Implement rate limiting on form submissions
Rate limiting controls how many times a single IP address or session can submit a form within a set period. Without it, a determined bot or a malicious actor can flood your form with submissions, fill your database with junk data, or use your form as a spam relay.
Most security and form plugins include rate limiting settings. Common configurations include:
- Maximum of three form submissions per IP address per hour
- Maximum of one submission per session per minute
- Blocking IPs that trigger a threshold within a short window
Rate limits that are too strict can block legitimate repeat enquiries from the same visitor. If your business legitimately receives multiple submissions from the same person (for example, a contractor submitting several quote requests), set limits that feel generous enough for real users but tight enough to disrupt automated tools.
Check logging and monitoring for form activity
Logging records form submission attempts so you can spot unusual patterns, diagnose failed submissions, and investigate suspected abuse. Without logs, you have no evidence when something goes wrong.
What to log:
- Submission timestamp and IP address
- Form identifier (contact, quote, booking)
- Submission status (success, failed validation, blocked as spam)
- Error messages when submissions fail
Do not log full submitted content including email addresses, phone numbers, or message text unless you have a clear reason and appropriate data handling processes in place. Logging PII increases your data protection responsibilities.
For sites handling more than a few submissions per day, a monitoring setup that alerts you to sudden spikes in form activity is more useful than reviewing logs manually. Website security review before going live covers monitoring setup as part of a broader security baseline.
Verify backup coverage for form-related data
Backups protect you against data loss from failed updates, accidental deletion, or server problems. For a WordPress site with forms, your backup strategy should cover the database tables where form submissions are stored, not just files and media.
Most backup plugins back up the full database, which includes form data tables. However, some plugins store submissions in custom tables that need explicit inclusion in the backup configuration. Check that your backup setup actually captures the relevant tables.
Test your backups periodically. A backup that has never been verified is not a reliable backup. Restore a recent backup to a test environment and confirm that form data appears correctly.
Set a regular review cadence
Doing a security review once and forgetting about it leaves your site exposed over time. A repeating schedule keeps your site in step with updates, plugin changes, and evolving threats.
A practical review cadence for a small business WordPress site looks like this:
- Weekly: Check that WordPress core, plugins, and themes are updated. Review any error logs or failed form submissions.
- Monthly: Check for abandoned plugins and look for better-maintained alternatives. Review spam submission volume for anomalies. Test email sending by submitting a test form.
- Quarterly: Run a full form and plugin security review. Test backups. Review user accounts and remove any that are no longer needed.
- After any major change: Verify form submissions are working, email is delivering, and spam protection is active whenever you update WordPress, change themes, or add a new plugin.
Consistency matters more than perfection. A site that gets a basic weekly check is far more secure than one that gets a thorough review once a year and then accumulates neglect for the rest of it.
Common security mistakes to avoid
Several recurring mistakes appear frequently during WordPress security reviews:
- Leaving default usernames: The admin account should not be called "admin" or use any easily guessed username. Bots try common usernames first.
- Using weak passwords for admin accounts: A strong password with mixed characters is a basic but effective defence. Where possible, use two-factor authentication on admin accounts.
- Not restricting the login page: The wp-admin and wp-login.php pages should not be publicly accessible to everyone. Limiting access to specific IP addresses or using a login protection plugin reduces brute-force risk.
- Ignoring PHP version compatibility: WordPress and many plugins require a supported PHP version to function securely. Checking PHP version support on shared hosting is part of keeping your site on a secure foundation.
- Installing plugins from unverified sources: Only install plugins from the official WordPress directory or reputable vendors. Nulled or pirated plugins commonly contain backdoors and malicious code.
When to handle WordPress security yourself and when to ask for help
Running through a checklist like this is manageable for most site owners if you have a little technical confidence and access to your hosting dashboard. The weekly checks, update process, and SMTP testing are routine tasks that most people can learn.
However, there are situations where professional support is the better choice:
- Your site has been hacked or you suspect compromise
- Custom form code is involved and something is not working after updates
- You do not have access to your hosting control panel or DNS settings
- Spam submissions are getting through despite active protection, suggesting a more sophisticated issue
- You need a thorough audit rather than a checklist walkthrough, particularly before a site launch
A WordPress security audit goes beyond a checklist by examining plugin code quality, server configuration, access controls, and potential vulnerabilities that are not visible from the WordPress admin area alone.
Next practical step
If your WordPress site has not had a form and plugin security review in the past three months, work through the checklist above starting with the update check and SMTP test. Those two steps alone resolve the majority of issues N. Cristea finds on small business WordPress sites that are not performing reliably.
If you work through the checklist and find something that does not look right, or if spam submissions are getting through despite active protection, get in touch to discuss the specific issue. A targeted investigation is usually quicker and more effective than trying to resolve recurring form problems through generic advice.