Most WordPress security incidents aren't the result of a sophisticated attack — they're the result of an outdated plugin, a reused password, or a hosting environment that hasn't been touched since launch. WordPress powers a huge share of the web precisely because it's flexible, but that same flexibility (thousands of third-party plugins and themes) is also where most real-world compromises originate. The good news: a handful of consistent habits prevent the overwhelming majority of them.
Here's a practical WordPress security checklist covering what actually matters, in roughly the order of impact.
1. Keep WordPress core, plugins, and themes updated
This is the single highest-leverage item on this list. The majority of real-world WordPress compromises exploit a known vulnerability in an outdated plugin or theme — one that already had a patch available. Attackers actively scan the web for sites still running vulnerable versions. Set core updates to install automatically for minor releases, and check plugin/theme updates weekly at minimum.
2. Remove plugins and themes you're not using
An inactive plugin is still a potential attack surface if it isn't deleted, not just deactivated. Every unused plugin or theme on a site is one more piece of code that could contain a vulnerability nobody is watching for. Audit installed plugins periodically and remove anything not actively in use.
3. Use strong, unique passwords and limit login attempts
Weak or reused admin passwords combined with unrestricted login attempts is the second most common compromise path after outdated plugins — brute-force and credential-stuffing bots target the default /wp-login.php and /wp-admin URLs constantly. Use a password manager to generate unique, long passwords for every admin account, and use a plugin or hosting-level setting to lock out an IP after a handful of failed attempts.
4. Turn on two-factor authentication
Even a strong password can be compromised through phishing or a data breach on another site (password reuse). Two-factor authentication — a code from an authenticator app in addition to the password — stops the overwhelming majority of automated account takeover attempts even if a password does leak.
5. Rename or restrict the default admin username
Sites still using "admin" as the administrator username are giving attackers half the credentials they need for free. Create a uniquely named admin account, and if the original "admin" account exists from an old install, delete it (after transferring ownership of any content) rather than just changing its password.
6. Choose hosting built for WordPress
Generic shared hosting often lacks server-level malware scanning, isolated environments between sites on the same server, and prompt security patching. Managed WordPress hosting typically includes a web application firewall, automatic malware scanning, and server hardening specifically tuned for WordPress's common attack patterns — worth the incremental cost for any business-critical site.
7. Run automated, offsite backups
Security isn't only about prevention — it's also about recovery. A site with automated daily backups stored off the same server can be restored within minutes if something does go wrong, turning a potential disaster into a minor inconvenience. Test the restore process at least once; a backup you've never restored from is an assumption, not a safety net.
8. Install an SSL certificate
SSL (the padlock and https://) encrypts data between the visitor's browser and the server, which matters for any site with a login, contact form, or checkout. It's also a confirmed Google ranking signal and a baseline trust expectation — most browsers now flag non-SSL sites as "Not Secure" directly in the address bar.
9. Limit user roles to what people actually need
Not every team member needs Administrator access. WordPress's built-in roles (Editor, Author, Contributor) let you grant exactly the permissions someone needs to do their job without giving them the ability to install plugins or change site-wide settings. Fewer full-admin accounts means fewer accounts an attacker could compromise to take over the whole site.
10. Disable file editing from the WordPress dashboard
By default, administrators can edit theme and plugin files directly from the dashboard's built-in code editor. If an attacker gains admin access, this feature hands them an easy way to inject malicious code. Disabling it (a single line added to wp-config.php) removes that path without affecting normal site operation.
11. Monitor for file changes and unusual activity
A security plugin with file integrity monitoring flags when core files, plugin files, or theme files change unexpectedly — often the first sign of a compromise, well before a site visibly breaks or gets flagged by Google. Catching this early is the difference between a five-minute cleanup and a multi-day recovery.
12. Keep PHP and server software current
WordPress itself isn't the only software that needs updates — the underlying PHP version and server software matter too. Older PHP versions lose security support over time, the same way outdated plugins do. Most good hosts handle this automatically, but it's worth confirming rather than assuming.
13. Review admin accounts periodically
Former employees, old contractors, or agencies that built the site years ago sometimes retain admin access long after the relationship ended. A periodic audit of who has access — and removing anyone who shouldn't — closes a surprisingly common and easily overlooked gap.
14. Use a web application firewall
A WAF filters malicious traffic before it reaches WordPress at all — blocking common attack patterns (SQL injection attempts, known exploit signatures) at the network level. Many managed hosts include this by default; if yours doesn't, a WAF plugin or a service like Cloudflare adds this layer.
15. Have a response plan before you need one
Even with every precaution above, no site is 100% immune. Knowing in advance who to call, where your latest backup lives, and how to restore it turns a potential emergency into a routine fix. This is where working with a team that manages WordPress maintenance and security on an ongoing basis pays for itself.
Why "set it and forget it" doesn't work
A common mistake is treating security as a launch-day task rather than an ongoing responsibility. A site that was locked down properly at launch can drift into vulnerability within months as new plugin versions ship, new vulnerabilities get disclosed in code that's still running, and admin accounts accumulate from contractors or team members who no longer need access. The businesses that avoid compromises long-term treat the items on this checklist as recurring maintenance — a monthly review of updates and accounts — rather than a one-time project.
It's also worth understanding what security work can't fully prevent: a determined, targeted attacker with enough resources can compromise almost anything. What this checklist protects against is the far more common scenario — automated bots scanning the entire web for known, unpatched vulnerabilities and weak credentials. That's the overwhelming majority of real-world WordPress compromises, and it's also the category that's genuinely preventable with consistent basics rather than expensive specialized tools.
The bottom line
WordPress security isn't a one-time setup — it's a small set of consistent habits: stay updated, use strong unique credentials with two-factor authentication, back up automatically, and choose hosting built for the platform. Businesses that treat these fifteen items as ongoing maintenance rather than a launch-day checklist rarely deal with a serious compromise. WordPress.org's own hardening guide is a solid technical reference to go deeper: Hardening WordPress.
If you'd rather not manage this yourself, our WordPress maintenance plans start at $99/month and cover updates, backups, and security monitoring on an ongoing basis. For a new build with security handled from day one, see our WordPress website design services, or get in touch for a free audit of your current site.
