A hacked website costs you sales, search rankings and customer trust. Most attacks are not clever. They use outdated plugins, weak passwords and forgotten user accounts. This WordPress security checklist shows you how to close those gaps.
Follow the 15 steps of this WordPress security checklist in order. Each one is short, practical and written for business owners, not developers. By the end, you will know how to secure a WordPress website and how to check it regularly.
Table of Contents
Why you need a WordPress security checklist
WordPress runs a very large share of the web. That makes it a popular target for automated attacks. Bots scan thousands of sites a day looking for known weaknesses. They do not care how big your business is.
A written WordPress security checklist turns security from a vague worry into a routine. You tick items off, fix what is missing and repeat the check on a schedule. It is the same idea pilots use before every flight.
Here is what a typical attack looks like in practice:
- A bot finds an outdated plugin with a known vulnerability.
- It uploads a malicious file or creates a hidden admin user.
- Your site starts sending spam, redirecting visitors or showing warnings in Google.
- You lose traffic first, then trust, then money.
Every step in this list blocks one of those paths. You do not need all of them on day one, but you should not skip any of them for long.
WordPress security checklist: keep everything updated and lean
Step 1: Update WordPress core, plugins and themes
Most hacked sites run software with a known fix that was never installed. Turn on automatic updates for minor core releases and security patches. Check plugins and themes at least once a week. Updates come first on any WordPress security checklist.
Test major updates on a staging copy first if your site takes orders or bookings. That way a broken update never reaches your customers.
Step 2: Delete unused plugins and themes
Deactivated plugins can still be attacked. If you do not use something, delete it. Keep one default theme as a fallback and remove the rest.
Fewer plugins also means a faster site and fewer updates to track.
Step 3: Choose secure hosting and a current PHP version
Your host is the foundation of your security. Look for isolated accounts, server-level firewalls, malware scanning and daily backups. Cheap shared hosting often skips all four.
Run a supported PHP version. Old versions stop receiving security fixes, and no plugin can fully make up for that.
WordPress security checklist: lock down your login page
Step 4: Use strong, unique passwords
Every account needs its own long password. A password manager creates and stores them for you. Never reuse the password from your email, hosting or any other service. Strong passwords are the cheapest item on a WordPress security checklist.
Apply this rule to WordPress, your hosting panel, FTP and the database. Attackers who guess one often reach the rest.
Step 5: Turn on two-factor authentication for WordPress
Two-factor authentication WordPress setups ask for a second proof of identity after the password, usually a code from an app on your phone. Even if a password leaks, the attacker still cannot log in.
Enable it at least for every administrator and editor. It is one of the highest-impact items on a WordPress security checklist. Authenticator apps are safer than SMS codes, so choose an app-based option when your plugin offers one.
Step 6: Limit login attempts
Brute-force bots try thousands of passwords against wp-login.php. A login limiting feature locks out an IP address after a few failed tries. Many security plugins and some hosts include it.
The official WordPress hardening guide explains the main login and server protections in more detail.
Step 7: Never use “admin” as a username
The username admin is the first guess for every bot. Create a new administrator with a unique name, move your content to it and delete the old account.
Also make sure the display name shown publicly is different from the login name.
Control who can do what
Step 8: Give users the lowest role they need
Not everyone needs to be an administrator. A writer only needs the Author or Contributor role. A shop manager only needs shop access.
Fewer admins means fewer high-value accounts to protect. Least privilege is a basic rule of every WordPress security checklist.
Step 9: Review and remove old user accounts
Former employees, freelancers and agencies often keep access for years. Open the Users screen every quarter and delete accounts nobody needs. Reset passwords for the ones you keep if you are unsure who has them. Make this a fixed part of your WordPress security checklist routine.
Step 10: Protect wp-config.php and disable file editing
The wp-config.php file holds your database credentials. Keep it out of public reach and set strict file permissions on it.
Add define('DISALLOW_FILE_EDIT', true); to the file. This removes the theme and plugin editor from the dashboard, so an attacker who gets in cannot inject code from there.
Add protection layers and monitoring
Step 11: Add a web application firewall
A firewall filters malicious traffic before it reaches WordPress. It can run in a plugin or, better, at the DNS or server level. It blocks known attack patterns, bad bots and exploit attempts.
Check that it logs blocked requests so you can see what it actually does. A firewall belongs on every WordPress security checklist.
Step 12: Force HTTPS everywhere
An SSL certificate encrypts data between your visitors and your server. Redirect all HTTP traffic to HTTPS and fix mixed-content warnings. Browsers mark sites without it as not secure, which hurts conversions. HTTPS is a must-have on a WordPress security checklist.
Step 13: Back up your site automatically
Backups are your last line of defence. Store them off the server, for example in cloud storage, and keep several versions. Daily backups suit most business sites. Shops with frequent orders may need more.
A backup you have never restored is only a hope. Test a restore at least twice a year. No WordPress security checklist is complete without tested backups.
Step 14: Scan for malware and monitor activity
Schedule malware scans and turn on alerts for file changes, new admin users and failed logins. Early warning turns a disaster into a ten-minute fix.
An activity log also shows who changed what, which is useful when several people manage the site.
Step 15: Repeat the WordPress security audit on a schedule
Security is not a one-time job. Put a WordPress security audit in your calendar every month or quarter and walk through this WordPress security checklist again. Write down what you changed and when.
Also prepare a simple incident plan: who to call, where the latest backup is and how to take the site offline if needed.
How to run a WordPress security audit
A WordPress security audit is a structured review of your site against a WordPress security checklist like this one. You can do a basic version yourself in under an hour.
- Open the Updates screen and install everything pending.
- List all plugins and themes. Delete what you do not use.
- Open the Users screen. Check roles and remove old accounts.
- Confirm two-factor authentication is on for every admin.
- Check that the last backup is recent and restorable.
- Review firewall and scan reports for anything unusual.
- Visit your site over HTTPS and look for browser warnings.
Record the date and the results. Next time, you will see quickly whether things got better or worse. Keep the WordPress security checklist and your notes together.
When to hand your WordPress website security checklist to a specialist
You can complete most of this WordPress security checklist yourself. Some parts are harder: server-level firewalls, malware cleanup and ongoing monitoring. A mistake there can take your site offline.
If you run a store, take bookings or collect customer data, professional help is cheap insurance. Our website security services cover audits, hardening, monitoring and recovery. Ongoing care is also part of website management in the UAE, so updates and backups never get forgotten.
Not sure where your site stands? Describe your setup and we will point out the biggest gaps first.
WordPress Security Checklist FAQ
What is a WordPress security checklist?
It is a list of actions that protect a WordPress site from hacking, malware and data loss. It covers updates, strong logins, two-factor authentication, user roles, firewalls, backups and monitoring. You work through it once, then repeat it on a schedule.
How do I secure a WordPress website quickly?
Update core, plugins and themes, delete unused plugins, set strong unique passwords and turn on two-factor authentication. Then install a firewall and set up automatic off-site backups. These steps stop most common attacks and take only a few hours.
How often should I run a WordPress security audit?
Run a basic WordPress security audit every month or at least every quarter. Check updates, users, backups and scan reports. Shops and sites with many editors should audit more often, and always after installing a new plugin or changing hosts.
Is two-factor authentication for WordPress really necessary?
Yes. Passwords leak in breaches and phishing, and many people reuse them. Two-factor authentication means a stolen password alone is not enough to log in. Enable it for every administrator and editor, preferably with an authenticator app instead of SMS.
Do I need a security plugin if my host has a firewall?
A host firewall is a good base, but it does not replace everything. A security plugin adds login limits, file monitoring and malware scans inside WordPress. Use one tool per job and avoid installing several overlapping security plugins.
What should I do first if my WordPress site is hacked?
Take the site offline or put it in maintenance mode, change all passwords and restore a clean backup if you have one. Then update everything and scan for leftover malware. If you are unsure, ask a security specialist to clean and harden the site.
Summary
A good WordPress security checklist is simple: update everything, protect logins, limit access, add layers and review regularly. Start with steps 1, 4, 5 and 13, because they stop the most common attacks.
Then work through the rest of the list during the next few weeks. Small, steady improvements beat one big panic after a hack. Save this WordPress security checklist and share it with whoever manages your site.
Want your WordPress site audited and hardened by experts?
The Webcity team checks your site against this checklist, fixes the gaps and sets up monitoring and backups for you.
Explore our website security services or contact us to request a security review.
