Most videographers aren’t targeted personally. Attackers scan millions of websites automatically, looking for outdated software. A small portfolio site on an old plugin is just as easy to find as a big company’s site, and often easier to break into.
The good news is that most of the protection comes from a handful of habits, not expensive tools. Work through the checklist once, then keep the short routine further down.
Why videographer websites get hacked
- Lots of plugins: galleries, sliders, booking forms, page builders, SEO tools. Every plugin is code that can have flaws.
- Infrequent updates: in busy season, nobody logs in to update anything for weeks.
- Shared logins: second shooters, editors or freelancers given an admin account that’s never removed.
- Old PHP versions: sites still on PHP 7.4 or 8.0, which no longer get routine security fixes. October 2026’s PHP2Shell flaws showed why that matters.
Patchstack’s 2026 report also found that 46% of WordPress vulnerabilities had no patch available when they were disclosed. That’s why removing plugins you don’t use is as important as updating the ones you do.
Outside help adds risk too. Verizon’s 2026 Data Breach Investigations Report found third parties were involved in 48% of breaches. For a videographer, that means web designers, freelancers and any service that holds a login to your site or your clients’ files. Our guide to keeping client footage safe when you outsource covers the file side.
The videographer website security checklist
Check your PHP version
In WordPress, go to Tools › Site Health › Info › Server. It should be PHP 8.2 or newer, on the latest patch release. WordPress recommends 8.3 or greater, and PHP 8.2 security support ends on 31 December 2026.
Update everything
WordPress core, your theme and every plugin. Turn on automatic updates for plugins you trust.
Delete unused plugins and themes
Deactivated plugins can still be attacked if their files are on the server.
Turn on two-factor login
For every administrator account.
Review who has admin access
Remove old freelancers and give helpers the lowest role they need.
Set up off-site backups
Daily if you publish often, weekly at minimum, stored away from your host.
Use HTTPS everywhere
Your address bar should show a padlock on every page, including contact and booking forms.
Protect your forms
Add spam protection to contact and inquiry forms so they can’t be abused.
Check your hosting email
Security notices from your host often go to an inbox nobody reads.
Add your site to Google Search Console
Its Security Issues report tells you if Google detects hacked content or malware on your site.
Test a restore once a year
A backup you’ve never restored is a backup you can’t trust.
Plugins and themes: where most problems start
Source: Patchstack, State of WordPress Security in 2026 (data for 2025). Time to exploit is the weighted median for heavily targeted vulnerabilities.
Before installing any plugin, check when it was last updated and how many active installs it has. A gallery plugin that hasn’t been updated in two years is a risk, however good it looks.
The official WordPress hardening guide adds two rules worth following: download plugins and themes only from WordPress.org or well-known vendors,, and keep plugins updated or delete them.
How to turn on automatic updates in WordPress
With a median of 5 hours between disclosure and first exploit for heavily targeted flaws, waiting for your monthly check-in is too slow. WordPress has offered automatic updates for plugins and themes since version 5.5.
Plugins
Go to Plugins › Installed Plugins. In the Automatic updates column, click “Enable auto-updates” for each plugin you trust, or select several and use the bulk action menu.
Themes
Go to Appearance › Themes, click your theme and choose “Enable auto-updates” below the theme’s author.
Watch the emails
WordPress emails the site owner when automatic updates succeed or fail, so make sure the admin email address is one you read.
Keep manual control where it matters
For a page builder or booking plugin your whole site depends on, you may prefer to update by hand after a quick backup, but do it within days, not weeks.
Logins, passwords and access
Stolen logins are one of the most common ways into a website. Verizon’s 2026 Data Breach Investigations Report found that credential abuse was involved in 39% of breaches, and the human element in 62%.
- Use a password manager and a unique password for your website, hosting account and email.
- Turn on two-factor authentication for WordPress, your hosting account and your domain registrar.
- Never share one admin login. Give each person their own account so you can remove them later.
- Avoid obvious usernames. The WordPress hardening guide advises against admin names like “admin” or “webmaster”.
- Be suspicious of password-reset emails you didn’t request. Read our guide to phishing scams targeting wedding videographers.
Your email account deserves the same care as your website. Whoever controls your inbox can reset the password on almost everything else, including WordPress and your hosting.
WordPress settings that close common gaps
These come from the official WordPress hardening guide on developer.wordpress.org. Some need access to your files through your host’s file manager or SFTP. If you’re not comfortable editing them, ask your host or web designer, and take a backup first.
- Turn off the built-in file editor. Adding the line define( ‘DISALLOW_FILE_EDIT’, true ); to wp-config.php stops anyone with an admin login from editing plugin and theme code from the dashboard.
- Use standard file permissions. The guide suggests 755 for folders and 644 for files, with wp-config.php tighter, typically 400 or 440.
- Use SFTP, not FTP. SFTP encrypts the connection when you upload or edit files.
- Give each site its own database user. If you run several sites, one hacked site shouldn’t open the others.
- Keep server logs. Access and error logs help you or your host work out what happened if something goes wrong.
Client galleries and delivery links
Many videographers deliver films or preview galleries through their own site. Treat those pages as private client data, not marketing pages.
- Password-protect every gallery and use a different password for each couple or client.
- Expire old links. Remove or unpublish delivery pages once the client has downloaded their files.
- Keep galleries out of search. Hide private pages from search engines so they don’t appear in Google results.
- Don’t store raw footage on the web server. Keep masters in your backup system, not in a public uploads folder.
HTTPS and SSL: what browsers now expect
HTTPS encrypts what visitors send to your site, including names, emails and wedding dates typed into your inquiry form. Browsers have been pushing it for years. Google announced in February 2018 that from Chrome 68, every plain HTTP page would show a “Not secure” label in the address bar.
In October 2025, Google went further. Its Chrome security team said it planned to turn on the “Always Use Secure Connections” setting for public sites by default in Chrome 154, in October 2026. With it on, Chrome warns visitors before opening a public site that doesn’t use HTTPS. For a videographer, that’s a warning screen between a couple and your portfolio.
Check your certificate
Click the padlock in the address bar on your homepage and on your contact page.
Turn on a certificate
Look for SSL in your hosting panel, or ask your host.
Force HTTPS
Use your host’s HTTPS redirect setting so old http links forward automatically.
Update your WordPress address
Under Settings › General, both addresses should start with https://.
Fix mixed content
Embedded images or videos loaded over http can break the padlock. Replace those links with https versions.
WordPress lists HTTPS support among its recommended hosting requirements, alongside PHP 8.3 or greater.
A simple website security routine
Source: Cut Pro Media routine based on the WordPress hardening guide and Patchstack, State of WordPress Security in 2026. Times are estimates for a typical portfolio site.
Put these in the same calendar you use for shoots. The weekly check matters most in peak season, which is exactly when it tends to get skipped.
Signs your website has been hacked
- Administrator accounts or plugins you didn’t add.
- Google shows strange pages or foreign-language titles for your site.
- Visitors are redirected to other websites, especially on mobile.
- Your host suspends the account or warns about malware.
- Your contact form suddenly sends spam, or stops delivering inquiries.
- Google Search Console reports a security issue, or search results show a warning label next to your site.
Google’s Security Issues report groups problems into hacked content, malware and unwanted software, and social engineering such as deceptive pages. Google says affected pages can appear with a warning label in search results, or show a warning screen in the browser.
What to do if your website is hacked
Change passwords first
WordPress, hosting, email and domain registrar, from a device you trust.
Contact your host
Ask what they can see in the logs and whether they offer malware clean-up.
Restore a clean backup
Use one taken before the problem started. Our 3-2-1 backup guide covers how to keep those backups.
Update and remove
Update everything, delete unknown users and plugins, and check the PHP version.
Request a Google review
If Search Console flagged your site, fix every listed issue, then click Request Review and explain what you fixed. Google says reviews can take from a few days to a few weeks.
Tell affected clients if needed
If galleries or delivery links were exposed, let those clients know and send fresh links.
The same rule applies to anyone you work with. Before you give a partner access to files or logins, check how they handle them; our guide to choosing a wedding video editing partner lists the questions to ask.
Common questions
Sources: Patchstack, State of WordPress Security in 2026; Verizon, 2026 Data Breach Investigations Report, as summarised by Abnormal AI; Microsoft Security blog, “One simple action you can take to prevent 99.9 percent of attacks on your accounts” (20 August 2019); WordPress Developer Resources, Hardening WordPress (accessed 23 October 2026); WordPress.org Documentation, Plugins and themes auto-updates (accessed 23 October 2026); WordPress.org, Requirements (accessed 23 October 2026); php.net, Supported Versions (accessed 23 October 2026); Google Search Console Help, Security issues report (accessed 23 October 2026); Google Online Security Blog, “A secure web is here to stay” (8 February 2018); Google Online Security Blog, “HTTPS by default” (28 October 2025).
