Proudly Canadian 
A compromised WordPress site on Canadian hosting has consequences beyond inconvenience. Under PIPEDA and Law 25, a breach exposing personal information creates notification obligations and potential regulatory exposure. Search engines flag malware-infected sites with warnings that hurt rankings for months after cleanup. The steps here prevent the attacks that account for the overwhelming majority of WordPress compromises.
The login endpoint is where most attacks start
WordPress exposes its login form at /wp-login.php by default. Automated bots attempt hundreds of password combinations per second against every WordPress installation they find. Three measures address this. First, never use admin as a WordPress username. Create a new administrator account with a different username, log in as the new account, and delete the admin user. Second, add HTTP basic authentication to wp-login.php so requests require a server-level credential before WordPress even loads. Third, use a security plugin like Wordfence or Solid Security to rate-limit login attempts and block IPs exceeding a failure threshold. Five failed logins within ten minutes is a reasonable trigger for a 24-hour block.
WordPress file permissions on Canadian servers
The correct permission model: directories at 755, files at 644, and wp-config.php at 640 or 600. Check your installation from the command line:
find /path/to/wordpress -type d -perm 777 find /path/to/wordpress -type f -perm 666
Any results indicate files or directories with overly permissive settings that should be corrected. Incorrect permissions allow a compromised PHP process to modify its own installation files, which is how many malware injections persist after initial cleanup.
Keep plugins and themes updated
The majority of WordPress compromises exploit known vulnerabilities in outdated plugins and themes. WPScan, a publicly available vulnerability database, lists known CVEs for thousands of plugins with the versions where vulnerabilities were fixed. Automated scanners check sites for outdated plugin versions and attempt exploits within hours of a CVE being published. Enable automatic background updates for minor WordPress core versions and configure plugin update notifications so no plugin is more than a few days behind the current security release.
Disable file editing in the WordPress admin
WordPress includes code editors in the admin under Appearance, Editor and Plugins, Editor. If an attacker gains admin access, these provide immediate file write access to the entire installation. Disabling them costs nothing. Add this to wp-config.php:
define('DISALLOW_FILE_EDIT', true);PIPEDA and Law 25 safeguard obligations
A Canadian business server storing personal information that has never been hardened, runs outdated software, and uses password authentication for SSH would have difficulty demonstrating appropriate safeguards following a breach. The hardening steps above are standard practice and their absence is difficult to justify in a compliance context under either PIPEDA or Law 25.
Gotekky
Need help deciding what to do next?
Tell us what you are seeing and what outcome you need. We will identify whether a managed service, scoped project or paid technical assessment is the right next step.