Guide · 9 November 2026

Security and GDPR checklist for your company website (WordPress)

Most SMEs in Portugal run their website on WordPress — and most of those sites have at least one easy-to-fix weakness. The good news: you don't need to be technical to grasp the key points. This is a practical, plain-language checklist to reduce risk and get closer to GDPR compliance.

WordPress security

• Update everything. WordPress core, theme and plugins. Most attacks exploit old versions with known, already-patched flaws.
• Cut down on plugins. Every plugin is a door. Uninstall the ones you don't use (deactivating isn't enough).
• Strong passwords and 2FA. Turn on two-factor authentication for admin accounts. Avoid the "admin" username.
• Limit login attempts. Stops brute-force attacks.
• Automatic backups. And above all, test the restore — a backup that was never tested may fail when you need it.
• HTTPS across the whole site. Valid certificate and http-to-https redirect.

Exposure that shouldn't be visible

• Protected login page (restrict access, hide the WordPress version).
• Sensitive files and folders with no public access (backups, .sql, wp-config).
• Spoofable email. Set up SPF, DKIM and DMARC on your domain to make it harder for someone to send emails pretending to be your company.

GDPR on the website — the essentials

• A real cookie banner. No loading marketing cookies before consent. The user must be able to decline as easily as accept.
• A clear privacy policy: what data you collect (forms, newsletter), why, for how long, and how to exercise rights.
• Minimal forms: ask only for the data you need. Less data, less risk.
• Explicit consent for newsletters and marketing contact.
• Processors: if you use external services (hosting, email, analytics), you should have data-processing agreements and know where the data is stored.

Common mistakes we see

• Plugins not updated in months.
• Contact forms with no consent and no linked policy.
• Cookie banners with only an "Accept" button.
• Backups kept on the server itself (if the server goes down, they go with it).
• Admin accounts shared by several people.

How Kourian helps

We run a passive assessment of your site — what's exposed, outdated or misconfigured, from both a security and a GDPR angle — and deliver a clear, prioritised plan to fix it. No alarmism, no jargon.

Want to know how your site is doing? Request a check.

Note: this article is informational and does not replace legal advice on GDPR.