Patching and auditing

Most break-ins use vulnerabilities that already had a fix. Patching quickly is the highest-value security habit.

Automate security updates

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

This installs security fixes daily. Still schedule a monthly window for full upgrades and reboots.

Don't forget the application

The OS is only half. Keep WordPress core, plugins and themes, PHP versions and Node packages updated too. Remove plugins you don't use; disabled plugins can still be exploited.

Audit regularly

• sudo lynis audit system gives a hardening score and a list of concrete suggestions.
• Review last and /var/log/auth.log for unexpected logins.
• List users with sudo: getent group sudo.
• Look for world-writable files in your web root: find /var/www -perm -o+w -type f.

Know what changed

Tools like AIDE record file checksums and alert you when system files change unexpectedly, which is a common sign of compromise.