WordPress security checklist
The WordPress hardening list in order of impact: updates, tested restores, least-privilege accounts, 2FA and the monitoring that catches what slips through.
14 checks · copy it, print it, argue with it.
WordPress gets hacked plenty, but almost never the way people fear — exotic zero-days are rare; stale plugins and shared admin logins are everywhere. This list is ranked by real-world impact: do the top items and you have eliminated the attack paths that actually get used.
Tier 1 — Stops the majority of real attacks
- Core, plugins and theme on a real update scheduleweekly minimum; same-day for security releases — and know your PHP version is supported
- Unused plugins and themes deleted, not deactivateddeactivated code is still on disk and still exploitable
- Backups running, off-server, and a restore tested this quarterfiles + database, retained long enough to predate any hack
- Two-factor authentication on every admin accountand on hosting, domain registrar and email — the castle around the castle
- No shared "admin" login — named accounts onlywhen someone leaves, you disable one account, not change every password
Tier 2 — Hardening that pays for itself
- Least-privilege roles enforcededitors edit; only the owner holds administrator — and no admin for API scripts
- Login hardening: rate limiting on wp-loginor moved behind protection at the hosting layer
- Hosting-level firewall (WAF) enabledmost managed hosts offer one; it absorbs scanner noise you never see
- HTTPS everywhere, forcedincluding admin — mixed content breaks both security and trust
- File permissions sane and uploads isolatedor confirm your host does this — "who can write what" is the whole game
Tier 3 — The safety net
- Uptime monitoring pointed at a humandefacements are usually found by customers otherwise
- An activity log kept for admin actionswhen something odd happens, "who did what when" should be answerable
- Plugin acquisition discipline: fewer, reputable, maintainedevery plugin is a supply-chain decision — check its update history before installing
- An incident plan written downrestore first, patch after, rotate keys, then forensics — decided in daylight, not during
Security is a maintenance posture, not a one-time setup. The sites that stay clean are the boring ones: updated, backed up, least-privileged, watched.
Quarterly, and only when the numbers move
Get the rate report before you negotiate.
Updated rate bands across the major stacks and regions, plus what changed and why. No other email.