6.3Best practices & pitfalls
The essentials in 30 seconds
- Back up, test, document: three reflexes that prevent most serious incidents.
- Least privilege: everyone gets their own account, permissions and access — never one shared administrator for everyone.
- Durable simplicity: few plugins, a child theme, monitored updates and backups that are actually tested.
Samir thread — the reflexes that held
After several years on the studio's sites, Samir has kept a few simple reflexes: back up before acting, test on a copy, document access and refuse shortcuts he does not control. The pitfalls, meanwhile, always come back the same way: haste and undocumented changes.
A good practice is not a rule for show: each one prevents a known failure or waste of time.
What makes the difference
Two sites can have the same design and a very different fate. What separates them comes down to discreet choices: a tested backup, a child theme, proper permissions, monitored updates. These choices do not show at the demo — they show six months later.
Think ownership and handover
The client must own their domain name, their hosting and their access. A site where the provider keeps every account is a prison site. Samir documents access and plans the handover from the start.
Security is not a plugin
A security plugin helps, but it replaces neither updates, nor strong passwords, nor limiting administrator accounts, nor backups. Security is hygiene, not a button to switch on.
The right reflexes
- Back up before any update or sensitive change.
- Test on a pre-production environment or a copy when possible.
- Create one account per user with just the right level of permissions.
- Document access, plugins and maintenance procedures.
The pitfalls to avoid
- Editing the parent theme or the WordPress core directly.
- Stacking plugins without checking their usefulness and maintenance.
- Leaving a shared administrator account or a weak password.
- Believing a backup exists without ever having tested its restoration.
Ready-to-say script — defending backups (25 s)
“Before every intervention, I make a backup and check that it can be restored. That is what lets us fix things without risking your content or your orders.”
Keep this to justify backup time to a client in a hurry.
Ready-to-say script — refusing a shortcut (20 s)
“I would rather use a child theme than edit the theme directly: otherwise the next update wipes everything. It takes a little longer now, but it lasts.”
Explain the cost of the shortcut, not just the rule.
Copy-paste template — basic security checklist
1. Updates monitored (core, themes, plugins)
2. One account per user, minimal permissions
3. Strong passwords + 2FA for admins
4. Automatic backup + tested restoration
5. HTTPS active and valid certificate
6. Unused plugins removed
7. Access documented and handed to the clientCopy-paste template — handover sheet
DOMAIN / HOSTING: _______________
ADMIN ACCESS: _______________
THEME + CHILD THEME: _______________
USEFUL PLUGINS: _______________
BACKUPS: _______________
MAINTENANCE CONTACT: _______________
UPDATE PROCEDURE: _______________Small business / tight budget
Automatic backup, security updates and a child theme: the minimal foundation.
Non-profit
Named accounts and permissions suited to volunteers, with an offboarding procedure.
Shop
Backups before every critical update and an order test afterwards.
Agency
Delivery checklist, documentation and contracted maintenance.
48h challenge — apply tomorrow
Audit a site: accounts, permissions, tested backup, child theme and unnecessary plugins. Fix one point and note the others. 25 minutes.
- I apply the backup and testing reflexes.
- I give just the right level of permissions.
- I document access and procedures.
Which practice protects a WordPress site most durably?
Best practices are measured over time: a site taken over six months later must remain understandable, backed up and maintainable.