A WordPress security checklist is a short list of habits and settings that close the doors attackers use most: outdated software, weak logins, risky plugins and missing backups. Work through the 15 steps below once, then repeat the recurring ones on a schedule, and your site will be far harder to compromise.
WordPress itself is well maintained. Most hacked sites are not victims of clever, targeted attacks. They are hit by automated bots scanning millions of sites for a known weak spot. Your job is simply to not be the easy target.
Each step below is written for site owners, not security engineers. Where a step involves code, you can copy it exactly.
The WordPress security checklist at a glance
Use this table as your quick reference, then read the details for each step below.
| # | Step | How often |
|---|---|---|
| 1 | Update WordPress core, plugins and themes | Weekly |
| 2 | Install only trusted plugins and themes | Every install |
| 3 | Remove unused plugins, themes and users | Quarterly |
| 4 | Run a supported PHP version | Twice a year |
| 5 | Strong passwords and two-factor authentication | Once, then for new users |
| 6 | Limit login attempts | Once |
| 7 | Give users the lowest role they need | Quarterly review |
| 8 | Restrict access to wp-admin | Once |
| 9 | Use SSL and force HTTPS | Once |
| 10 | Set correct file permissions | Once, then after migrations |
| 11 | Disable the built-in file editor | Once |
| 12 | Keep off-site, restorable backups | Daily (automatic) |
| 13 | Use one reputable security plugin | Once |
| 14 | Monitor activity and uptime | Ongoing |
| 15 | Know what to do if you are hacked | Plan now |
Keep your software current and clean
1. Update WordPress, plugins and themes
Outdated plugins are the most common way into a WordPress site. When a vulnerability is published, bots start scanning for it quickly. Turn on automatic updates for minor WordPress releases and for plugins you trust, and log in weekly to apply the rest. For major updates on business-critical sites, test them on a WordPress staging site first.
2. Install only trusted plugins and themes
Before installing anything, check that it was updated recently, has a solid number of active installs and good reviews, and comes from the official directory or a reputable developer. Never use “nulled” (pirated) premium themes or plugins. They frequently contain hidden backdoors.
3. Remove what you do not use
A deactivated plugin is still code sitting on your server, and it can still be exploited. Delete plugins and themes you are not using (keep one default theme as a fallback). Remove old user accounts belonging to former staff, freelancers and agencies.
4. Run a supported PHP version
PHP versions reach end of life and stop receiving security fixes. In your hosting control panel, switch to a currently supported PHP 8.x version that your plugins work with. As a bonus, newer PHP is also faster.
Lock down logins and user accounts
5. Use strong passwords and two-factor authentication
Every account with access to your site should have a long, unique password stored in a password manager. Then add two-factor authentication (2FA) for every administrator and editor, using an authenticator app. 2FA stops most attacks that rely on stolen or guessed passwords. Do the same for your hosting account and domain registrar.
6. Limit login attempts
By default, WordPress lets anyone guess passwords endlessly. A login protection or security plugin can lock out an IP address after a few failed attempts. Also avoid “admin” as a username, since it is the first one bots try.
7. Apply least-privilege user roles
Give each person the lowest role that lets them do their job:
- Administrator: only the site owner and one trusted technical person.
- Editor: people who manage everyone’s content.
- Author: people who write and publish their own posts.
- Contributor: people who write but need approval to publish.
- Shop Manager: WooCommerce staff who handle orders but not site settings.
8. Restrict access to wp-admin
Reduce how much of your login area is exposed. Options include allowing wp-admin only from specific IP addresses, adding an extra password layer in front of the login page, or moving the login URL with a plugin. If you do not use the WordPress mobile app or remote publishing, disable xmlrpc.php, which is a popular target for password-guessing attacks.
Harden your server and files
9. Use SSL and force HTTPS
An SSL certificate encrypts logins and form submissions so passwords cannot be read in transit. Make sure your WordPress Address and Site Address both start with https:// and redirect all HTTP traffic to HTTPS. Our guide to SSL certificates explains how it works.
10. Set correct file permissions
Wrong permissions can let other processes modify your files. The standard safe settings are:
- Folders:
755 - Files:
644 wp-config.php:640or600
Never set anything to 777, even if a tutorial suggests it.
11. Disable the built-in file editor
WordPress lets administrators edit theme and plugin code from the dashboard. If an attacker gets into an admin account, that editor lets them inject malicious code in seconds. Add this line to wp-config.php to switch it off:
define('DISALLOW_FILE_EDIT', true);
Back up, protect and monitor
12. Keep restorable backups
Backups are your safety net when everything else fails. You want automatic daily backups, stored away from your live site, that include both files and the database, and that you have actually tested restoring. See our website backups guide for a simple backup strategy.
13. Use one reputable security plugin
A good security plugin adds a firewall layer, login protection, malware scanning and alerts when core files change. Choose one well-known option and configure it properly. Running two security plugins together often causes conflicts and slows your site.
14. Monitor your site
Problems found early are cheaper to fix. Set up:
- An uptime monitor that emails you if your site goes down.
- An activity log to see who changed what and when.
- Google Search Console, which warns you if Google detects malware or hacked content.
- File change alerts from your security plugin.
15. What to do if your WordPress site is hacked
Signs include unknown admin users, strange redirects, spam pages in Google results, or a browser warning. If it happens, follow this order:
- Do not panic, and do not delete everything. You may need the evidence.
- Change every password: WordPress users, hosting, database, FTP or SSH, and email.
- Contact your host. They can help identify infected files and check server logs.
- Restore a clean backup from before the infection, or clean the infected files and database.
- Update everything and remove the vulnerable plugin or theme that let the attacker in.
- Generate new security keys (salts) in
wp-config.phpto log out every session. - Request a review in Google Search Console if your site was flagged.
The most important part is step 5. If you restore without fixing the cause, you will likely be hacked again.
How HostRiser helps
Several of these steps come built in on HostRiser. Every plan includes free Let’s Encrypt SSL that is issued and renewed automatically, daily backups you can restore yourself in one click (a whole site, single files, databases or email), a choice of PHP versions, and security tools in our control panel. Staging sites on our Rise and Summit plans let you test updates safely, and if something goes wrong, real hosting experts are on hand through support tickets. Explore our WordPress hosting to see everything included.
Frequently asked questions
Is WordPress secure enough for a business website?
Yes. WordPress core is actively maintained and patched quickly. Most hacked WordPress sites are caused by outdated plugins, weak passwords or pirated themes, all of which this checklist addresses.
Do I need a security plugin if my host already has protection?
Server-level protection blocks a lot of attacks, but a reputable security plugin adds WordPress-specific features like login protection, file change alerts and malware scanning. Use one good plugin, not several that overlap.
How often should I update WordPress plugins?
Check for updates at least weekly and apply security updates as soon as they are released. For major updates on important sites, test on a staging copy first.
Should I change the WordPress login URL?
It can cut down on automated login attempts, but it is not real protection on its own. Strong passwords, two-factor authentication and login attempt limits matter far more.
What should I do first if my WordPress site is hacked?
Stay calm, change all passwords, and contact your host. Then restore a clean backup from before the hack or clean the infected files, update everything, and find out how the attacker got in.
Bookmark this checklist and work through it today. When you are ready for hosting that handles the basics for you, compare our plans and prices.
Last updated October 12, 2026
