WordPress Security Checklist: 15 Steps to Protect Your Website

WordPress itself is secure when it is looked after. Most hacked sites have the same story: outdated plugins, weak passwords, no backups and nobody watching. This checklist covers the steps that prevent the vast majority of problems.

Updates and software

1. Keep WordPress core, themes and plugins updated. Most attacks target known vulnerabilities in outdated plugins.
2. Delete unused plugins and themes. Deactivated code can still be exploited if it stays on the server.
3. Only install plugins from trusted sources. Never use “nulled” (pirated) premium plugins — they often contain malware.
4. Run a supported PHP version. Old PHP versions stop receiving security fixes.

Logins and users

1. Use strong, unique passwords and a password manager.
2. Turn on two-factor authentication (2FA) for every admin account.
3. Limit login attempts to stop brute-force attacks.
4. Give each person their own account with the lowest role they need. Remove old accounts of past developers and staff.
5. Don’t use “admin” as a username.

Hosting and configuration

1. Choose reputable hosting with server-level firewalls, malware scanning and isolated accounts.
2. Use HTTPS everywhere with a valid SSL certificate.
3. Disable file editing in the dashboard (the DISALLOW_FILE_EDIT setting), so a stolen login can’t be used to edit theme or plugin code.

Backups and monitoring

1. Automatic, off-site backups. Daily for active sites and stores. Store copies somewhere other than your hosting account — and test that a backup actually restores.
2. Use a security plugin or firewall to scan for malware and block malicious traffic.
3. Monitor uptime and Google Search Console. Search Console alerts you if Google detects security issues on your site.

If the worst happens

If your site has already been hacked, don’t panic — follow a structured recovery process. I wrote a step-by-step guide here: My WordPress site was hacked — what now?

Want this handled for you?

Security hardening is part of my speed & security optimization and maintenance plans. Not sure where you stand? Start with a free website audit.