WordPress Security Checklist: Essential Steps to Protect Your Website From Hackers

Because WordPress is so popular, it's also a favourite target for automated attacks. The good news is that most successful hacks exploit preventable weaknesses: outdated plugins, weak passwords, pirated themes and poor hosting. This checklist covers the steps that stop the vast majority of attacks.

Key takeaways

• Keep WordPress core, themes and plugins updated.
• Use strong passwords and two-factor authentication for every admin.
• Install only reputable plugins and never use nulled themes.
• Run daily off-site backups and test restores.
• Add a firewall and monitor for changes.

1. Update everything

Enable automatic minor core updates, update plugins and themes weekly after checking compatibility, and remove anything inactive. Outdated plugins are the most common entry point for attackers.

2. Secure logins

• Unique, long passwords stored in a password manager.
• Two-factor authentication for all administrators and editors.
• Limit login attempts and add bot protection to the login page.
• Avoid "admin" as a username.
• Give users only the role they need.

3. Choose plugins and themes carefully

Install from WordPress.org or reputable vendors, check update frequency and reviews, and never use pirated ("nulled") themes or plugins, which often contain malware.

4. Use a security plugin and firewall

Security plugins add malware scanning, login protection and file change detection. A web application firewall (plugin-based or at the CDN level, such as Cloudflare) blocks malicious requests before they reach WordPress.

5. Harden configuration

6. Backups

Take automatic daily backups stored off the server, keep at least 30 days of history and test restoring regularly. See WordPress backup strategies.

7. Secure hosting

Choose hosting with account isolation, malware scanning, automatic backups and up-to-date server software. Managed WordPress hosting adds extra protection.

8. Monitor

Watch for new admin users, file changes, unusual traffic and Google Search Console security warnings. Set up uptime monitoring with alerts.

If something goes wrong

Follow a clear recovery process. See how to recover a hacked WordPress site.

Security plugin comparison

Choose one main security plugin to avoid conflicts.

Monthly security routine

1. Update core, plugins and themes.
2. Review users and remove unused accounts.
3. Check scan results and file change alerts.
4. Confirm backups exist and test a restore periodically.
5. Check SSL expiry and Search Console security reports.

Common mistakes to avoid

• Leaving inactive plugins and themes installed.
• Shared admin accounts.
• No 2FA for administrators.
• Ignoring security plugin alerts.

Security for WooCommerce stores

Keep payment plugins updated, use gateways that handle card data off-site, limit admin and shop manager roles, enable 2FA for all staff accounts, monitor orders for fraud and back up the database frequently.

Choosing a maintenance partner

Look for a provider who handles weekly updates, daily backups, uptime and malware monitoring, monthly reports and fast incident response, with clear responsibilities in writing.

Monthly WordPress security routine

Least privilege for your team

Give each person their own account with the lowest role they need: Editor for content writers, Shop Manager for store staff, Administrator only for those who manage the site. Turn on two-factor authentication for every admin, and remove accounts the day someone leaves. Shared passwords are one of the most common causes of breaches.

See web development for maintenance plans.

Frequently asked questions

Sources and further reading

• WordPress.org: Hardening WordPress
• OWASP Top 10