WordPress Security Checklist: 15 Steps to Protect Your Site

To secure a WordPress site, keep core, plugins and themes updated, remove what you do not use, enforce strong passwords and two-factor authentication, limit admin accounts, run on a supported PHP version with HTTPS, put a web application firewall in front of the site and keep tested off-site backups. The 15 steps below cover each of these in order of impact.

Softwix has built and maintained WordPress and WooCommerce sites for clients in Bangladesh, the UK, the US and Europe since 2017. This checklist reflects the security basics our WordPress development team recommends for new builds and maintenance work, written so a site owner can follow it without a developer.

WordPress security checklist at a glance

#	Step	Effort	How often
1	Update core, plugins and themes	Low	Weekly or automatic
2	Delete unused plugins and themes	Low	Quarterly
3	Vet plugins before installing	Low	Every install
4	Use strong, unique passwords	Low	Once, then on staff changes
5	Turn on two-factor authentication	Low	Once
6	Limit admin accounts and roles	Low	Quarterly review
7	Limit login attempts	Low	Once
8	Run a supported PHP version	Medium	Yearly
9	Force HTTPS everywhere	Low	Once
10	Add a web application firewall	Medium	Once, then monitor
11	Disable the file editor	Low	Once
12	Set correct file permissions and protect wp-config.php	Medium	Once, then after migrations
13	Restrict database privileges	Medium	Once
14	Keep tested off-site backups	Medium	Daily or weekly
15	Monitor activity and file changes	Medium	Ongoing

Why do WordPress sites get hacked?

Most WordPress sites are compromised through vulnerable plugins and themes, not WordPress core. Attackers scan the web automatically for sites running known-vulnerable versions, so small sites are targeted just as often as large ones.

Patchstack’s State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42% rise on 2024. Of these, 91% were in plugins and 9% in themes, while WordPress core had only six, all low priority.

The same report found that 46% of vulnerabilities had no patch available at the time of public disclosure, and that the median time to mass exploitation for heavily targeted vulnerabilities was five hours. In other words, waiting a week to update is often too slow, and updating alone is not always enough.

What are the 15 steps to secure a WordPress site?

Work through these steps in order. The first seven cost little or nothing and close the most common entry points; the later steps add depth for business and e-commerce sites.

1. Keep WordPress core, plugins and themes updated

Updates are the single most important security step because they close known vulnerabilities. The official WordPress hardening guide states that you should always keep up to date with the latest version, and download WordPress only from wordpress.org.

Since WordPress 5.5 you can switch on automatic updates for individual plugins and themes. According to WordPress.org’s auto-updates documentation, WordPress checks twice a day by default and emails you about successes and failures.

• Enable auto-updates for well-maintained plugins with a good update record.
• For critical plugins such as WooCommerce or page builders, test updates on a staging copy first, then apply them within days.
• Check Tools > Site Health to confirm scheduled tasks are running, as auto-updates rely on WP-Cron.

2. Delete plugins and themes you do not use

A deactivated plugin can still contain exploitable files. If you are not using it, delete it.

Keep one default theme as a fallback and remove the rest. Fewer components also make updates faster and the site easier to maintain.

3. Vet every plugin before installing it

Check a plugin’s maintenance record before it touches your site. On WordPress.org, look at the last update date, the “tested up to” version, active installations and how the developer handles support threads.

Be careful with premium plugins too. Patchstack’s 2026 report found that 76% of vulnerabilities in premium components were exploitable. Never install “nulled” copies of paid plugins; they are a common way malware is distributed.

4. Use strong, unique passwords

Every account with access to the site needs a long, unique password stored in a password manager. This includes WordPress users, hosting, the database, SFTP and the domain registrar.

WordPress has a built-in password strength meter. Use it, and do not accept weak passwords from editors or shop managers just because their role seems minor.

5. Turn on two-factor authentication

Two-factor authentication (2FA) stops an attacker who has stolen or guessed a password. The hardening guide recommends it as an extra layer for logins.

The free Two Factor plugin, developed by WordPress community contributors, supports authenticator apps (TOTP), email codes and backup codes. Make 2FA mandatory for administrators and shop managers at a minimum.

6. Limit admin accounts and use the right roles

Give each person the lowest role that lets them do their job. A blog writer needs Author or Editor, not Administrator.

• Do not use “admin” as a username; the hardening guide specifically recommends changing it.
• Give every person their own account so actions can be traced.
• Remove accounts for former staff, freelancers and agencies as soon as the work ends.
• Review the user list every quarter.

7. Limit login attempts

Bots try thousands of password combinations against wp-login.php. Limiting failed attempts, or adding a challenge after several failures, makes these attacks impractical.

Most security plugins and many managed hosts include this. You can also add server-level password protection to /wp-admin/, which the hardening guide lists as an additional layer.

8. Run a supported PHP version

Old PHP versions stop receiving security fixes. WordPress.org’s requirements page recommends PHP 8.3 or greater and MySQL 8.0 or MariaDB 10.11 or greater, and warns that older versions which technically still work have reached end of life and may expose your site to vulnerabilities.

Test a PHP upgrade on staging first, because outdated plugins sometimes break. Newer PHP versions also tend to run faster, which ties in with our guide to speeding up a WordPress site.

9. Force HTTPS across the whole site

HTTPS encrypts logins, form submissions and checkout data between the visitor and your server. WordPress.org lists HTTPS support as a requirement.

Install an SSL certificate (most hosts offer free ones), set both WordPress and site URLs to https://, and redirect all HTTP requests. Use SFTP rather than plain FTP when transferring files, as the hardening guide advises.

10. Put a web application firewall in front of the site

A web application firewall (WAF) blocks malicious requests before they reach WordPress. It can also stop attacks on vulnerabilities that do not yet have a patch, which matters given how many are disclosed unpatched.

Hosting security alone is often not enough. In Patchstack’s 2026 report, a penetration test across hosting environments found that only 26% of vulnerability attack attempts were blocked. Use a plugin-level firewall, a DNS-level service, a virtual patching service or a combination.

11. Disable the built-in file editor

WordPress lets administrators edit theme and plugin code from the dashboard. If an attacker gets admin access, that editor lets them inject code in seconds.

Add this line to wp-config.php, as the hardening guide recommends:

define( 'DISALLOW_FILE_EDIT', true );

12. Set correct file permissions and protect wp-config.php

Files should be writable only where WordPress needs to write. The hardening guide recommends 755 for directories and 644 for files, with /wp-content/ writable by the web server where uploads and updates require it.

Protect wp-config.php, which holds your database credentials and security keys. You can move it one directory above the WordPress installation or deny web access to it in your server configuration.

13. Restrict database user privileges

The database user WordPress connects with rarely needs full control. The hardening guide notes that normal operation needs only SELECT, INSERT, UPDATE and DELETE, and suggests revoking structural privileges such as DROP, ALTER and GRANT.

Be aware that some plugins and core updates may need to change the database structure, so grant extra privileges temporarily when upgrading if required. Also use a unique database password that is not shared with any other account.

14. Keep tested, off-site backups

Backups are your recovery plan when everything else fails. Back up both the database and the files, store copies away from your hosting account and keep several restore points.

• Daily backups for shops and sites that change often; weekly for brochure sites.
• At least one copy in separate cloud storage, not only on the same server.
• Test a full restore on staging every few months. An untested backup is a hope, not a plan.

15. Monitor activity, file changes and logs

Monitoring tells you something is wrong before your customers or Google do. The hardening guide suggests watching file changes and access logs.

• Use an activity log plugin to record logins, user changes and plugin installs.
• Set up uptime monitoring with email or SMS alerts.
• Check Google Search Console for security issue warnings.
• Run a malware scan regularly, and immediately after any suspicious behaviour.

A hacked site can also damage search visibility through spam pages and redirects, which is why security sits on our technical SEO checklist as well.

Which WordPress security plugin should you use?

Use one reputable security plugin, not several. Overlapping firewalls and scanners slow the site and can conflict.

Choose based on what your host already provides. If the host includes a server firewall and malware scanning, a lighter plugin for 2FA, login limits and activity logs may be enough. If not, a fuller suite with a firewall, scanning and vulnerability alerts makes sense. Whatever you choose, it does not replace updates, backups and good account hygiene.

What should you do if your WordPress site is hacked?

Act quickly, in this order: contain, clean, close the hole and recover trust.

1. Put the site into maintenance mode or take it offline if it is redirecting visitors or serving malware.
2. Change every password: WordPress users, hosting, database, SFTP and email.
3. Restore a clean backup from before the infection, or have the files and database cleaned professionally.
4. Update everything and remove the plugin or theme that let the attacker in.
5. Regenerate the security keys and salts in wp-config.php to log out all sessions.
6. Request a review in Google Search Console if Google flagged the site.
7. If customer data may have been exposed, check your legal obligations, for example under UK GDPR for UK customers.

Frequently asked questions

Is WordPress secure enough for a business website?

Yes, when it is maintained properly. Patchstack’s 2026 report found only six vulnerabilities in WordPress core during 2025, all low priority. The risk comes mainly from outdated plugins and themes, weak passwords and missing backups, all of which this checklist addresses.

How often should I update WordPress plugins?

Check for updates at least weekly, and apply security releases as soon as possible. With mass exploitation of popular vulnerabilities sometimes starting within hours of disclosure, automatic updates for reliable plugins are a sensible default. Test major updates to critical plugins on staging first.

Do I need a security plugin if my host has security features?

Often you still need some protection at the WordPress level, such as two-factor authentication, login limits and activity logs. Check what your host includes and fill the gaps rather than installing everything. Avoid running two firewall plugins at once.

Does changing the login URL improve security?

It reduces automated login attempts and log noise, but it is not a substitute for strong passwords and 2FA. Treat it as a minor extra layer. Make sure every team member knows the new URL before you change it.

How much does WordPress maintenance cost?

It depends on the size of the site, how many plugins it runs and whether it is a shop. A maintenance plan typically covers updates, backups, uptime and security monitoring, and fixes when something breaks. Ask any provider exactly which of the 15 steps above are included.

Get help securing your WordPress site

Start with the first seven steps today; they take an afternoon and close the most common entry points. Then schedule the remaining steps, and put backups and monitoring on a recurring routine.

If you would rather hand it over, or your site has already been compromised, contact Softwix for a security review, clean-up or ongoing WordPress maintenance.