WordPress security checklist
The WordPress hardening list in order of impact: updates, tested restores, least-privilege accounts, 2FA and the monitoring that catches what slips through.
14 checks · copy it, print it, argue with it.
WordPress gets hacked plenty, but almost never the way people fear, exotic zero-days are rare; stale plugins and shared admin logins are everywhere. This list is ranked by real-world impact: do the top items and you have eliminated the attack paths that actually get used.
Tier 1, Stops the majority of real attacks
- Core, plugins and theme on a real update scheduleweekly minimum; same-day for security releases, and know your PHP version is supported
- Unused plugins and themes deleted, not deactivateddeactivated code is still on disk and still exploitable
- Backups running, off-server, and a restore tested this quarterfiles + database, retained long enough to predate any hack
- Two-factor authentication on every admin accountand on hosting, domain registrar and email, the castle around the castle
- No shared "admin" login, named accounts onlywhen someone leaves, you disable one account, not change every password
Tier 2, Hardening that pays for itself
- Least-privilege roles enforcededitors edit; only the owner holds administrator, and no admin for API scripts
- Login hardening: rate limiting on wp-loginor moved behind protection at the hosting layer
- Hosting-level firewall (WAF) enabledmost managed hosts offer one; it absorbs scanner noise you never see
- HTTPS everywhere, forcedincluding admin, mixed content breaks both security and trust
- File permissions sane and uploads isolatedor confirm your host does this, "who can write what" is the whole game
Tier 3, The safety net
- Uptime monitoring pointed at a humandefacements are usually found by customers otherwise
- An activity log kept for admin actionswhen something odd happens, "who did what when" should be answerable
- Plugin acquisition discipline: fewer, reputable, maintainedevery plugin is a supply-chain decision, check its update history before installing
- An incident plan written downrestore first, patch after, rotate keys, then forensics, decided in daylight, not during
Security is a maintenance posture, not a one-time setup. The sites that stay clean are the boring ones: updated, backed up, least-privileged, watched.
Quarterly, and only when the numbers move
Get the rate report before you negotiate.
Updated rate bands across the major stacks and regions, plus what changed and why. No other email.
Want this checklist executed for you? Get a scoped quote, two minutes now, a written answer with price and timeline in two days.