WordPress Security Checklist: 30 Steps to Protect Your Site

Quick answer: The most important WordPress security steps are: keep core, plugins and themes updated; use strong unique passwords with two-factor authentication; take daily off-site backups; remove unused plugins and themes; use secure hosting with a firewall; and give users only the access they need. The checklist below covers 30 steps grouped by area, so you can work through them in one afternoon.

Use this as a practical to-do list. For explanations of why each step matters, see our full WordPress security guide. Tick off each section, then repeat the monthly items regularly.

Logins and users (steps 1–7)

1. Use a long, unique password for every admin (a password manager helps).
2. Turn on two-factor authentication for all admins and editors.
3. Don’t use “admin” as a username.
4. Remove users who no longer need access.
5. Give each person the lowest role they need (Editor, Author, Contributor) — see the official roles and capabilities guide.
6. Limit login attempts or use a firewall that blocks brute-force attacks.
7. Never share one login between several people.

Updates (steps 8–11)

8. Keep WordPress core updated; leave minor auto-updates on.
9. Update plugins and themes weekly, or enable auto-updates for trusted ones.
10. Use a supported PHP version (ask your host or check the hosting panel).
11. Follow vulnerability news for the plugins you use — see WordPress vulnerability news.

Plugins and themes (steps 12–16)

12. Delete plugins and themes you don’t use (deactivated code can still be a risk).
13. Only install from WordPress.org or reputable developers.
14. Never use nulled (pirated) themes or plugins.
15. Check “last updated” dates — avoid abandoned plugins.
16. Keep one default theme installed as a fallback.

Backups (steps 17–20)

17. Run automatic daily backups of files and database.
18. Store backups off-site (cloud storage, not just your server).
19. Keep at least 30 days of backups.
20. Test a restore at least twice a year. Our backup guide shows how.

Hosting and server (steps 21–25)

21. Choose a host with a firewall, malware scanning and isolated accounts — see best WordPress hosting.
22. Use HTTPS everywhere with a valid SSL certificate.
23. Use SFTP or SSH instead of plain FTP.
24. Use strong passwords for hosting, database and email accounts too.
25. Turn on two-factor authentication for your hosting and domain registrar accounts.

WordPress configuration (steps 26–28)

26. Disable file editing in the dashboard by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.
27. Set correct file permissions (typically 755 for folders, 644 for files) — see the official hardening guide.
28. Turn off debug display on live sites (debug mode guide).

Monitoring (steps 29–30)

29. Set up uptime monitoring and security alerts by email.
30. Check Google Search Console for security issues and unexpected pages.

Quick printable checklist

Area	Do now	Repeat
Logins	Strong passwords, 2FA, remove old users	Quarterly user review
Updates	Update everything	Weekly
Plugins/themes	Delete unused	Monthly
Backups	Daily off-site backups	Test restore twice a year
Hosting	SSL, SFTP, 2FA on hosting	Annual review
Config	Disable file editing	After major changes
Monitoring	Uptime and security alerts	Check alerts weekly

Security for sites with several users

Sites with many editors, authors or customers need a few extra steps. Require two-factor authentication for every role that can publish. Review the user list each quarter and remove people who have left. Use an activity log plugin, so you can see who changed what and when. For WooCommerce or membership sites, make sure customer accounts can’t access the dashboard, and check that registration forms are protected from spam sign-ups. If contractors need temporary access, create a separate account for them and delete it when the job is done instead of sharing your own login.

Don’t forget the server layer

Your WordPress settings are only half of security. The software underneath — PHP, the web server and the operating system — must be patched too. In October 2026, the PHP2Shell vulnerabilities showed how a server-level flaw can expose sites even when every plugin is up to date. Add these server checks to your list:

• Confirm your PHP version is still supported and patched (Tools → Site Health → Info → Server).
• Ask your host how quickly they apply security patches and how they notify customers.
• If you run your own VPS, turn on automatic security updates for the operating system and restart PHP after updates.
• Remove old copies of the site (like /old or /backup folders) that run outdated code.

A 15-minute monthly security routine

1. Minutes 1–3: open Dashboard → Updates and apply pending updates.
2. Minutes 4–6: check your backup log and confirm the latest backup finished.
3. Minutes 7–9: review Users for unknown accounts or role changes.
4. Minutes 10–12: look at your security plugin or host alerts for blocked attacks or file changes.
5. Minutes 13–15: check Google Search Console for security issues and unusual pages.

Put it in your calendar. Small, regular checks prevent most of the problems that lead to emergency clean-ups.

Which steps matter most?

If you only have 30 minutes, do these five: update everything, delete unused plugins, turn on two-factor authentication, confirm off-site backups work, and change any weak passwords. Most hacked WordPress sites are compromised through outdated plugins or stolen passwords, so these steps stop the majority of attacks.

Security for small teams and freelancers

If several people work on your site, security depends on habits as much as settings. Use a shared password manager instead of sending logins by email or chat. Give freelancers their own temporary accounts and remove them when the work is done. Agree who is responsible for updates and backups each month, so nothing falls between the cracks. Keep a simple document listing where the site is hosted, who has access and how to restore a backup. In an emergency, that one page saves hours.

Keep a recovery plan ready

Write down how to restore your latest backup, who to contact at your host, and where your passwords are stored. Test the restore once. When something goes wrong, a plan turns panic into a 30-minute job.

Review the plan once a year, or whenever you change host or hire a new developer.

Do you need a security plugin?

A good security plugin bundles several checklist items: firewall, login protection, malware scanning and alerts. It’s helpful but not a replacement for updates, backups and good passwords. If your host already provides a firewall and scanning, you may only need login protection and 2FA.

What to do if your site is hacked

1. Don’t panic — and don’t delete everything.
2. Change all passwords (WordPress, hosting, database, FTP).
3. Restore a clean backup from before the hack, or have the site professionally cleaned.
4. Update everything and remove the plugin that was exploited.
5. Request a review in Google Search Console if your site was flagged.

Keeping a regular maintenance routine makes recovery much easier.

FAQ

How often should I check WordPress security?

Updates weekly, a quick review monthly and a full checklist review every quarter.

Is WordPress secure?

Yes. WordPress core is well maintained; most problems come from outdated plugins, weak passwords and poor hosting.

Should I hide wp-admin?

It can reduce bot noise, but strong passwords, 2FA and a firewall matter far more.

WordPressPrime.com is an independent guide and is not affiliated with the WordPress Foundation, WordPress.org or Automattic. Always back up your website before making changes, and check official sources for the latest details.