The Ultimate WordPress Security Checklist

This is the ultimate WordPress security checklist we actually run on client sites, ordered by how much risk each step removes per minute of effort. Most WordPress hacks aren’t clever attacks on your server; they’re automated bots exploiting a known plugin vulnerability or a weak admin password. Work through the list below and you’ll close the doors that roughly 90% of those bots are rattling.

First, Understand What Actually Breaks WordPress Sites

WordPress core itself is rarely the weak point. According to vulnerability data compiled by researchers throughout 2024 and 2025, the overwhelming majority of disclosed WordPress vulnerabilities live in third-party plugins, with themes a distant second and core accounting for a very small slice.

That changes how you should think about a security checklist. You’re not defending a fortress wall, you’re managing a supply chain of code written by dozens of different authors.

The three attack patterns worth planning for:

• Automated vulnerability scanning: bots crawl the web looking for a specific plugin version with a public exploit, often within 48 hours of disclosure.
• Credential attacks: brute force and credential stuffing against /wp-login.php and XML-RPC using leaked password lists.
• Abandoned code: a plugin whose developer stopped updating it in 2025 sits on your site quietly waiting for someone to find a hole.

Part 1: The 30-Minute Hardening Sprint

If you only have half an hour, do these six things. They’re the highest-return items on the entire checklist and none of them require a developer.

1. Force strong passwords and 2FA on every administrator account. Two-factor authentication defeats credential stuffing outright, which is the single most common entry point.
2. Delete the “admin” username and any dormant admin accounts left over from a past developer or agency.
3. Update WordPress core, themes and plugins, then enable auto-updates for security releases at minimum.
4. Remove every deactivated plugin and unused theme. Inactive code is still executable code sitting on your server.
5. Install a reputable security plugin (Wordfence, Solid Security or Patchstack) and turn on login rate limiting.
6. Verify your backups restore. An untested backup is a hope, not a recovery plan.

That sprint alone moves most sites from “trivially compromised” to “not worth a bot’s time.” Everything below deepens it.

Part 2: Hosting and the Server Layer

Your host controls the parts of WordPress security you can’t patch from the dashboard. Cheap shared hosting where one compromised neighbour can reach your files is a structural risk, not a bargain.

• Run PHP 8.2 or newer; older branches stop receiving security fixes and drag performance down too.
• Confirm your host offers server-level isolation, daily off-server backups and a staging environment.
• Force HTTPS sitewide with a valid certificate and redirect all HTTP traffic once.
• Turn off directory browsing so /wp-content/uploads/ doesn’t list its contents to strangers.
• Use SFTP or SSH keys rather than plain FTP, which transmits credentials in the clear.

If you’re still weighing providers, our guide on how to choose the best WordPress hosting provider covers what to ask before you sign up.

Part 3: Logins, Users and Permissions

Every user account is an attack surface, and freelancers, VAs and former staff tend to accumulate. Audit your user list quarterly and downgrade anyone who doesn’t genuinely need publishing power.

• Apply least privilege: writers get Author, clients get Editor, only one or two people hold Administrator.
• Enable two-factor authentication for Administrator and Editor roles without exception.
• Limit login attempts to around 5 tries, then lock the IP for 20 minutes or longer.
• Disable XML-RPC unless you rely on the Jetpack app or a remote publishing tool.
• Consider changing the login URL from /wp-admin; it’s obscurity rather than real security, but it cuts bot noise in your logs dramatically.

Our walkthrough on managing WordPress users, roles and permissions explains exactly which capabilities each role carries.

Part 4: Themes and Plugins (Your Real Risk)

Treat plugins the way a warehouse treats suppliers: fewer, vetted, and reviewed on a schedule. A typical business site runs 15 to 25 plugins, and trimming that number is genuinely a security measure.

Before you install anything, check four things:

For a closer look at this topic, see our guide: Best WordPress Security Plugins to Keep Hackers Out.

1. Last updated date. Anything untouched for more than 12 months is a liability.
2. Active installs and support activity. Popular plugins get audited more often and patched faster.
3. Vulnerability history in the WPScan vulnerability database, which tracks disclosed WordPress issues by plugin and version.
4. Source. Never install nulled or “free premium” themes and plugins; backdoored downloads are one of the most common infection routes we see.

Update on a fixed cadence rather than reflexively, and always test on staging first. Our guide to safely updating WordPress core, themes and plugins covers a rollback-friendly process, and if something breaks, troubleshooting plugin conflicts is the next stop.

Part 5: File and Configuration Hardening

These steps take a developer or a comfortable FTP user about 20 minutes, and they blunt an attacker’s ability to escalate once they’re inside. The official WordPress hardening documentation covers the same ground in more technical detail.

• Set file permissions to 644 for files and 755 for directories, with wp-config.php at 600 or 640 where your host allows it.
• Add define('DISALLOW_FILE_EDIT', true); to disable the built-in theme and plugin editor.
• Rotate your security salts and keys in wp-config.php, which invalidates every existing session.
• Block PHP execution inside /wp-content/uploads/ so an uploaded file can’t be run.
• Move wp-config.php one directory above the web root if your hosting setup supports it.
• Add HTTP security headers: HSTS, X-Content-Type-Options, X-Frame-Options and a Content-Security-Policy you’ve actually tested.

Part 6: Monitoring, Firewalls and Logs

Detection matters as much as prevention, because the average compromised site runs infected for weeks before anyone notices. A web application firewall plus an activity log gives you both the block and the paper trail.

• Run a WAF at the edge (Cloudflare) or the application layer (Wordfence, Patchstack) to filter known exploit patterns.
• Keep a WordPress security audit log recording logins, plugin changes, user role edits and file modifications.
• Schedule malware and file-integrity scans at least weekly, with email alerts on core file changes.
• Watch the Security Issues report in Google Search Console, which is often the first place a hack surfaces publicly.

Part 7: Backups and Recovery

Backups are the one item on this security checklist that saves you when everything else fails. Follow the 3-2-1 rule: three copies, two media types, one off-site.

• Back up files and database daily for active sites, weekly for brochure sites that rarely change.
• Store copies off the web server, on cloud storage your WordPress install can’t write to.
• Retain at least 30 days of versions so you can roll back past a slow-burning infection.
• Do a test restore every quarter onto staging and time it, so you know your real recovery window.

We compared the tools that handle this well in our roundup of the best WordPress backup plugins.

The Gap Most Checklists Skip: Security Is an SEO Problem

Almost every WordPress security checklist stops at “install a firewall” and never mentions what a compromise costs you in search. That omission is expensive, because pharma hacks and injected spam links can wipe out years of ranking work in days.

When Google detects a compromise it can apply a manual action, flag your site through Safe Browsing (that red interstitial), or quietly deindex the affected URLs. Google’s own hacked site recovery documentation notes that reconsideration reviews add days to recovery on top of your cleanup time.

So bake a search-health check into your monthly routine: run a site: search for pages you didn’t publish, watch for sudden index bloat, and confirm your schema markup and canonical tags haven’t been rewritten by injected code. If crawl and index metrics move without a content or technical change, treat it as a security signal rather than an algorithm update.

Verifying Your Work: Audit Tools and Public Checklists

Once you’ve completed the steps above, verify externally rather than trusting your dashboard. Run WPScan against your domain to enumerate visible plugin and theme versions the way an attacker would, and check the results against known vulnerability records.

Developers often search for a WordPress pentesting checklist on GitHub, and several community-maintained repositories are genuinely useful for structured testing. Treat them as a validation layer on top of this checklist, not a replacement, since many focus on exploitation rather than day-to-day hardening.

A Realistic Maintenance Cadence

Security decays. A site hardened perfectly in 2025 and then ignored is not a hardened site in 2026, so put the recurring work in a calendar.

• Weekly: apply plugin and core updates on staging, review the malware scan, skim the activity log.
• Monthly: test a backup restore, audit user accounts, check Search Console for security issues.
• Quarterly: rotate passwords and salts, remove unused plugins, re-run an external scan.
• Annually: review your host, PHP version, firewall rules and disaster recovery plan end to end.

If you’re building a new site, fold these items into your launch process from day one using our checklist for launching a new WordPress site. Retrofitting security is always slower than starting with it.

Frequently Asked Questions

How long does it take to work through a WordPress security checklist?

Budget 30 minutes for the core sprint and 3 to 4 hours for the full checklist on a typical business site. File-level hardening and header configuration take the longest, especially on managed hosting where some directives are locked.

Do I need a paid security plugin?

Free tiers of Wordfence or Solid Security cover most small sites adequately, while paid plans (roughly $99 to $199 per year) add real-time firewall rules and faster vulnerability feeds. For sites handling payments or customer data, the paid tier is worth it for the delay reduction alone.

Is WordPress actually less secure than other platforms?

No, but it powers over 40% of all websites, so it attracts proportionally more automated attacks. The vulnerabilities that get exploited are overwhelmingly in third-party plugins and themes rather than WordPress core itself.

How do I know if my WordPress site has been hacked?

Common signals include unfamiliar admin users, unexpected redirects, spam pages showing in a site: search, sudden traffic drops and warnings in Google Search Console. A file-integrity scan comparing your core files against the official release usually confirms it within minutes.

What should I do first if my site is already compromised?

Take the site offline or into maintenance mode, change all passwords and database credentials, then restore from a clean backup predating the infection. After cleanup, request a review in Search Console and keep monitoring logs for 30 days, since reinfection through the same hole is common.

Want a Second Set of Eyes on Your Site?

If you’d rather have someone run this WordPress security checklist for you and report back on what’s actually exposed, SEO Quirk handles hardening, cleanup and the search recovery work that follows a hack. There’s a reason clients prefer working with a local agency when their site goes down at 6pm on a Friday.