This records the permanent operational practices adopted after the security incident (see Website Recovery Timeline). It covers ongoing practice, not incident response.
Permanent practices
- Keeping WordPress core updated.
- Prompt plugin updates.
- Removing unused plugins and themes.
- Regular backups.
- Strong authentication.
- Monitoring Search Console.
- Monitoring server health.
- Periodic security reviews.
Guiding principle: technical health is a prerequisite for SEO
Technical issues should always be ruled out before making strategic SEO changes. A site with unresolved technical or security problems cannot be reliably assessed for SEO performance – rankings and traffic during that period reflect the technical issue, not the quality of the SEO work. This principle now sits alongside the Content Principles in the wider SEO strategy as an operational counterpart: content principles govern what to publish, this principle governs when it’s safe to judge or act on SEO signals at all.