One of the main reasons to use WP Squared is that updates and site health for many WordPress sites are visible in one place. Combined with a few good habits, this keeps your sites patched and hard to break into, without spending hours in each WordPress dashboard.
Before you start
- Access to the WP Squared dashboard from MdmHost dashboard → Services.
- Working backups for each site, so you can roll back an update.
Set an update policy
| Component | Suggested policy |
|---|---|
| WordPress core minor and security releases | Automatic |
| WordPress core major releases | Manual, within a week, after a staging test for complex sites |
| Small and security plugins | Automatic |
| Shop, membership, builder plugins | Manual after reading the changelog |
| Themes | Automatic only with a child theme for custom code |
Configure these choices per site in WP Squared's update settings where available, or inside WordPress under Plugins → Installed Plugins → Enable auto-updates.
Apply updates centrally
- Open the WP Squared dashboard and look at the overview of sites with pending updates.
- Open a site and review which core, plugin and theme updates are waiting.
- Apply updates a few at a time, starting with security releases.
- Visit the site afterwards and check key pages and forms.
Use HTTPS everywhere
WP Squared issues free SSL certificates for your sites. Make sure every site loads on https://, that Settings → General in WordPress uses https:// addresses, and that there are no mixed content warnings in the browser.
Protect logins
- Use the one-click login from WP Squared instead of sharing admin passwords with colleagues.
- Give each person their own WordPress user with the lowest role they need: Editor for content, Administrator only for those who manage plugins.
- Enable two-factor authentication for administrators with a plugin such as Two Factor.
- Remove users who no longer work on the site.
Reduce the attack surface
- Delete inactive plugins and themes, keeping one default theme as a fallback.
- Add
define( 'DISALLOW_FILE_EDIT', true );towp-config.phpto remove the built-in code editors. - Disable XML-RPC if you do not use Jetpack or the legacy mobile app.
- Avoid nulled premium plugins and themes.
Respond to warnings
If WP Squared, WordPress Site Health or a security plugin reports a vulnerable plugin, update it the same day or deactivate it until a fix is out. If you see signs of a hack, such as unknown admin users or spam redirects, restore from a clean backup, update everything and change all passwords.
A monthly routine
- Review pending updates and apply the remaining manual ones.
- Check Tools → Site Health on each site for critical issues.
- Review administrator accounts.
- Test one restore on a staging copy.
Frequently asked questions
Does the server protect my sites too?
Yes. MdmHost servers run server-level security, malware scanning and brute-force protection. That protects against many automated attacks, but it cannot fix an outdated plugin or a weak administrator password inside WordPress. Both layers matter.
What if an automatic update breaks a site?
Restore the backup from before the update, then switch that plugin to manual updates and test its next release on staging. Report the problem to the developer so it gets fixed for everyone.
Should agencies give clients administrator access?
Give clients an Editor account for daily content work and keep Administrator for the people responsible for updates. This prevents accidental plugin installs that bypass your update policy.