WordPress Security Checklist: 15 Essential Steps

Over 90,000 WordPress sites are hacked every day, and most of those hacks are entirely preventable. This checklist covers every essential security step for a small business WordPress site, with how often each one actually needs attention.

The 15-Step Security Checklist

1. Keep WordPress core updated. Enable auto-updates for minor and security releases so patches apply the moment they're available. Major version updates are worth testing first, but security patches shouldn't wait for your next maintenance cycle.
2. Keep all plugins and themes updated. Apply security patches within 24 to 48 hours of release. Most successful WordPress hacks exploit a known vulnerability in an outdated plugin, not some novel attack, which makes staying current one of the single highest-leverage things you can do.
3. Use strong, unique passwords. Use a password manager to generate and store a unique password for every account with access to your site: admin, hosting, FTP, and database. Reused passwords are how a breach on one unrelated site turns into a breach on yours.
4. Enable two-factor authentication. Two-factor authentication makes brute-force and credential-stuffing attacks nearly impossible, since a stolen password alone isn't enough to get in. See our full 2FA guide for exactly how to set it up.
5. Change your admin username. Never use "admin" as your username. It's the first guess in every automated brute-force attack, and using anything else eliminates an entire category of attempts before they start.
6. Limit login attempts. Block an IP address after a handful of failed login attempts. Without this, your login page is exposed to unlimited automated password guessing around the clock.
7. Install a Web Application Firewall. A WAF like Cloudflare or Wordfence filters malicious requests before they ever reach WordPress, blocking a large share of attacks automatically without you having to do anything.
8. Install a security plugin. Wordfence, Sucuri, or MalCare scan your files for malware, alert you to suspicious changes, and give you visibility into what's actually happening on your site instead of finding out only after something breaks.
9. Install an SSL certificate. Every site needs HTTPS, both for the padlock visitors expect and because Google factors it into rankings. Most hosts include free SSL certificates now, so there's rarely a reason to skip this.
10. Set up reliable offsite backups. Backups should run daily, be stored somewhere other than your own server, and actually be tested occasionally. A backup is worth nothing if you discover it's corrupted the moment you need it.
11. Disable XML-RPC. XML-RPC is a frequent brute-force attack target and most small business sites don't need it enabled. Disabling it closes off an entire attack surface with no functional downside for most sites.
12. Hide your WordPress version. Don't broadcast which WordPress version you're running. Attackers scan for sites running versions with known, unpatched vulnerabilities, and hiding this detail removes an easy way for them to find you.
13. Audit WordPress users monthly. Review your list of users and remove accounts that shouldn't have access anymore: former employees, old freelancers, anyone who no longer needs it. Every active account is a potential entry point.
14. Secure wp-config.php. Set proper file permissions and use strong, unique secret keys. This file contains your database credentials, making it one of the highest-value targets on your entire site if an attacker gets partial access.
15. Monitor continuously. Run daily malware scans, watch Google Search Console for security alerts, and keep uptime monitoring active. Continuous monitoring is what catches a compromise in hours instead of the weeks it typically takes to notice otherwise.

Fifteen steps sounds like a lot, but most take minutes once you know what to do. It's staying consistent about all fifteen that's the hard part.

How Often Should You Run a Security Audit?

Run through this full checklist monthly, and treat updates, backups, and monitoring, items 1, 2, 10, and 15, as ongoing rather than monthly tasks. A security checklist done once and forgotten is barely better than not having one, since new vulnerabilities are discovered in WordPress plugins every week.

Frequently Asked Questions