Over 90,000 WordPress sites are hacked every day. Most hacks are entirely preventable. This checklist covers every essential security step for small business WordPress sites.
The 15-Step Security Checklist
1. Keep WordPress core updated — enable auto-updates for minor versions. 2. Keep all plugins and themes updated — security patches applied within 24–48 hours. 3. Use strong, unique passwords — use a password manager for every account. 4. Enable two-factor authentication — makes brute-force attacks nearly impossible. 5. Change your admin username — never use "admin" as your username. 6. Limit login attempts — block IPs after failed login attempts. 7. Install a Web Application Firewall — Cloudflare or Wordfence blocks malicious requests. 8. Install a security plugin — Wordfence, Sucuri, or MalCare for malware scanning. 9. Install SSL certificate — every site needs HTTPS in 2025. 10. Set up reliable offsite backups — daily, tested, 30-day retention. 11. Disable XML-RPC — frequent brute-force attack target. 12. Hide WordPress version — don't help attackers target known vulnerabilities. 13. Audit WordPress users monthly — remove accounts that shouldn't have access. 14. Secure wp-config.php — proper permissions, strong secret keys. 15. Monitor continuously — daily scanning, Google Search Console alerts, uptime monitoring.
Need help with your WordPress site?
Fast Web Experts provides WordPress maintenance, security, speed, and expert support for small businesses. Start with a free audit — results in 24 hours.
Get a free WordPress site audit →