WordPress Security Checklist: 15 Steps to Protect Your Site

A solid WordPress security checklist comes down to a few habits: keep WordPress, plugins and themes updated, use strong unique passwords with two-factor authentication, limit login attempts, keep tested backups off the server, and remove anything you do not use. None of this is exotic. Most hacked WordPress sites are compromised through outdated plugins, weak passwords or abandoned add-ons, not through clever attacks.

How to use this WordPress security checklist

Work through the steps in order. The first five give the biggest protection for the least effort, so do those today and schedule the rest over the next few weeks. Treat it as a routine, not a one-time task.

1. Keep WordPress core, plugins and themes updated

Outdated plugins are one of the most common ways sites get compromised, because known vulnerabilities are public once a fix is released.

• Update WordPress core, every plugin and every theme regularly.
• Enable automatic updates for plugins you trust and that rarely break, through the Plugins screen in the dashboard.
• For larger or e-commerce sites, test updates on a staging copy first, then apply them to the live site.
• Delete plugins that are no longer maintained by their authors and replace them.

Updating is not only about security. It also keeps your site compatible with the newer PHP versions your host will eventually require.

2. Use strong, unique passwords

Reused or short passwords are easy to crack or to find in leaked databases.

• Use long, random passwords generated by a password manager, and never reuse them across services.
• This applies to WordPress users, hosting control panel, database, SFTP/FTP and email.
• Do not keep a user called admin. Use a different username for administrators.
• Give each person their own account instead of sharing one login.

3. Turn on two-factor authentication (2FA)

Two-factor authentication means a stolen password alone is not enough to log in. WordPress core does not include 2FA by default, so use a reputable security or 2FA plugin that supports authenticator apps.

Enable it at least for administrators and editors, and for the store managers on a WooCommerce site. Save the recovery codes somewhere safe.

4. Limit login attempts

Bots try thousands of password guesses against wp-login.php. Limiting failed attempts slows them down dramatically.

• Use a plugin or a firewall service that blocks an IP after repeated failures.
• Consider hiding or protecting the login URL only as an extra, not as your main defence.
• If you do not use XML-RPC, ask your developer to restrict it, since it is another endpoint attackers probe.

5. Back up your site with the 3-2-1 rule

Backups are your safety net when something goes wrong, from a hack to a bad update.

The 3-2-1 idea is simple:

• 3 copies of your data (the live site plus two backups),
• on 2 different types of storage or locations,
• with 1 copy kept off-site, away from your hosting server.

Practical guidance:

• Back up both files and the database, on a schedule that matches how often your content changes. A store with daily orders needs more frequent database backups than a brochure site.
• Store at least one copy somewhere other than your host, such as separate cloud storage.
• Test a restore at least once. An untested backup is a hope, not a plan.
• Keep several older versions, because an infection may go unnoticed for days.

6. Remove unused plugins, themes and users

A deactivated plugin still sits on the server, and a vulnerable file can often be reached directly even when the plugin is switched off.

• Delete (not just deactivate) plugins and themes you do not use.
• You can keep one default theme as a fallback and delete the rest.
• Review the Users screen and remove old accounts, former staff and test users.
• Only install plugins and themes from the official WordPress directory or from vendors you trust. Avoid “nulled” (pirated) premium plugins, which are a classic way to get malware.

Fewer plugins also helps performance, a point also covered in the guide to speeding up WordPress.

7. Set correct file permissions

File permissions decide who can read, write or execute files on the server. Over-permissive settings let an attacker modify your code.

Commonly recommended values are:

• Directories: 755
• Files: 644
• wp-config.php: stricter than other files, for example 600 or 640 depending on your host’s setup

Never use 777 on anything. If a plugin tells you to, treat it as a red flag. Your host’s support team can confirm the right ownership and permission model for their environment. The WordPress hardening guide explains the details.

8. Disable the theme and plugin file editor

By default, administrators can edit theme and plugin code from inside the dashboard. If an attacker gets into an admin account, that editor lets them inject malicious code in seconds. Turn it off by adding this line to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

This only disables the built-in editor. You can still update plugins and themes normally and edit files through SFTP or version control. (A stronger setting, DISALLOW_FILE_MODS, also blocks updates and installs from the dashboard, so use it only if you manage updates another way.)

Always take a backup before editing wp-config.php, since a typo can take the site down.

9. Use SSL/HTTPS everywhere

HTTPS encrypts traffic between your visitors and your site, which protects logins, checkout details and form submissions. Browsers also warn visitors away from sites without it.

• Install an SSL certificate (many hosts offer free ones) and redirect all HTTP traffic to HTTPS.
• Make sure WordPress Address and Site Address in Settings use https://.
• Optionally force encrypted admin logins with define( 'FORCE_SSL_ADMIN', true ); in wp-config.php, after confirming HTTPS works.
• Fix mixed-content warnings so every image and script also loads over HTTPS.

10. Add a firewall or WAF

A web application firewall (WAF) filters malicious traffic before it reaches WordPress. You have two broad options:

• A plugin-based firewall (Wordfence is a well-known example) that runs inside WordPress.
• A cloud or DNS-level firewall (services such as Cloudflare or Sucuri) that filters traffic before it reaches your server.

Pick one, configure it properly and keep it updated. A firewall is a strong extra layer, but it does not make an outdated site safe.

11. Use unique security keys and a safe database setup

• Make sure the authentication keys and salts in wp-config.php are unique and random. WordPress provides a generator on its official API, and changing them logs everyone out, which is useful after an incident.
• Use a strong database password and a database user with only the permissions the site needs.
• Never put wp-config.php in a public repository.

12. Apply the principle of least privilege

Not everyone needs to be an administrator. Give writers the Author or Editor role, shop staff the Shop Manager role, and keep Administrator for the very few people who manage the site. A compromised low-level account does much less damage.

13. Monitor and scan regularly

• Use a reputable security plugin to scan for modified files and known malware.
• Turn on email alerts for new administrators and repeated failed logins, where possible.
• Check Google Search Console for security warnings. Hacks often show up as spam pages or strange redirects, which also damage your rankings. The WordPress SEO checklist shows what else to monitor there.

14. Choose decent hosting

Quality hosting provides isolated accounts, current PHP versions, server-level firewalls and reliable backups. Very cheap shared hosting with outdated software can undermine every other step. Ask your host about their security features and update policy.

15. Know what to do if your site is hacked

Have a plan before you need one. If you suspect a compromise (spam pages, redirects, new unknown admins, a host suspension notice or a browser warning), work through this order:

1. Stay calm and contain it. Put the site into maintenance mode or ask your host to suspend public access if it is serving malware.
2. Contact your host. They can often help identify the infection and may have server logs and backups.
3. Save a copy of the infected site for investigation before you change anything, if possible.
4. Change every password: WordPress users, hosting panel, database, SFTP/FTP and email. Reset the security keys in wp-config.php.
5. Restore a clean backup from before the infection, or clean the site thoroughly. Reinstall WordPress core, plugins and themes from official sources rather than trusting existing files.
6. Remove unknown admin users and unfamiliar files or scheduled tasks.
7. Find and fix the cause, usually an outdated or abandoned plugin or a weak password. Without this step, reinfection is likely.
8. Check Google Search Console for security issues. If Google flagged the site, request a review after cleaning. Google’s Search Central documentation has guidance on hacked sites.

If you are not confident cleaning a hacked site, get professional help rather than guessing. A half-cleaned site often hides a backdoor.

WordPress security checklist at a glance

• Updates applied to core, plugins and themes; unused ones deleted.
• Strong unique passwords, no admin username, 2FA on for privileged users.
• Login attempts limited and a firewall or WAF in place.
• 3-2-1 backups running, with one copy off-site and a restore tested.
• Correct file permissions and DISALLOW_FILE_EDIT set.
• HTTPS everywhere, unique security keys, least-privilege roles.
• Monitoring on, and an incident plan written down.

Frequently asked questions

How do I secure my WordPress website for free?

Most of the checklist costs nothing: update everything, use strong passwords, enable 2FA, remove unused plugins, add DISALLOW_FILE_EDIT, use HTTPS and keep backups. Free versions of well-known security plugins cover login limits and basic scanning.

Do I need a security plugin?

It is not mandatory, but one helps with scanning, login protection and alerts. Choose one reputable plugin and configure it, instead of stacking several that overlap and slow the site.

How often should I back up my WordPress site?

Match the frequency to how often the site changes. A blog that updates weekly may need weekly file backups, while an online store taking orders should back up its database daily or more often. Always keep an off-site copy and test restoring.

Can a hacked WordPress site be fully recovered?

Yes, in most cases, especially with a clean backup. The key is to remove the cause as well as the symptoms: update everything, change all credentials and check for hidden backdoors before putting the site back online.

Is WordPress itself insecure?

WordPress core is actively maintained and fixes are released promptly. Most compromises come from outdated plugins and themes, weak passwords and poor hosting. A well-maintained WordPress site can be very secure.

Conclusion

Following a WordPress security checklist is mostly about consistent routine: updates, strong credentials, 2FA, tested backups and a lean set of plugins. Do those well and you have already avoided the most common ways sites get hacked. If you want someone to audit or harden your site, or to rebuild it with fewer plugins, see how I work on my author page. Choosing a lean build also matters: read Elementor vs custom WordPress theme to see how it affects your security surface, then contact me for a security review.