Start with these checks: a secure host, prompt updates to core, themes and plugins, two-factor authentication on every admin account, offsite backups you have actually restored, and an edge firewall in front of the site. Tested backups and a written incident plan are non-negotiable, because no checklist stops every attack. What follows is the wordpress security checklist we use, in the order we would run it.
- Require two factor authentication for administrators and anyone with publishing rights, and give each person a separate account with the lowest role needed.
- Test major upgrades to checkout, forms, and booking plugins on a staging site first, with a rollback plan.
- Keep three backup copies across two types of storage, with one isolated copy, and test restores regularly while protecting online storage with two step verification.
- Log failed logins, file changes, and plugin activity, then alert a named person; keep host and recovery contacts reachable if email fails.
- Limit login and XML RPC traffic, and turn off XML RPC when the site does not use it, because bots target both routes.
Table of Contents
- Which checks should you run first on your WordPress site?
- How do you secure user accounts and logins?
- What is a sensible update policy for core, themes and plugins?
- How do you keep plugins and themes under control?
- How should you back up WordPress, and why test the restore?
- What should your host and firewall be doing for you?
- How do you spot and recover from an incident?
- What matters more than perfect protection?
- Want us to run this checklist for you?
- FAQ
- Sources
Which checks should you run first on your WordPress site?
Treat this as a run-sheet for a maintenance session. Tick things off as you go.
- Confirm your host isolates accounts, offers a firewall and applies server patches.
- Enforce HTTPS and consider HSTS.
- Keep WordPress core, themes and plugins updated.
- Enable automatic minor security updates.
- Use a password manager for strong, unique passwords.
- Turn on two-factor authentication for every administrator.
- Rename or delete any default “admin” username.
- Remove unused plugins and themes.
- Vet every new plugin before installing it.
- Set up automated, versioned backups stored away from your host.
- Put an edge WAF or CDN in front of the site.
- Rate-limit login and XML-RPC requests.
- Switch on audit logging and uptime alerts.
- Write down who to call when something goes wrong.
Now put them in an order that works in practice:
- Fix accounts and 2FA first, because stolen logins are the quickest way in.
- Update everything, then remove what you do not use.
- Check your backups exist, then restore one to a test location.
- Add the edge firewall and rate limits.
- Turn on logging and alerts.
- Write the incident contact list while you still feel calm.
How do you secure user accounts and logins?
Most break-ins we see start with a weak or reused password, not a clever exploit. WordPress’s own developer guidance on brute force attacks puts strong passwords, two-factor authentication and passkeys at the top of its defences. A few habits cover most of it:
- Store unique passwords in a password manager and never reuse them.
- Require two-factor authentication (an authenticator app or passkey) for administrators and anyone with publishing rights.
- Avoid “admin” as a username and keep the number of administrators small.
- Use application passwords for integrations, and revoke them when the job ends.
- For high-risk actions such as installing plugins or creating users, consider asking for fresh confirmation. The open-source WP Sudo project shows how this works: a stolen session cannot do much damage without a recent confirmation.
Pro Tip: Give each person their own login and the lowest role that lets them do their job. Shared accounts make it impossible to tell who did what.
What is a sensible update policy for core, themes and plugins?
Security releases exist because someone found a hole. The WordPress team recommends updating immediately when one lands, as the notes for version 6.7.10 show. Some releases fix serious problems, such as unauthenticated path traversal that could lead to remote code execution, and only the most recent branches get fixes, so stay on a supported version.
- Install security releases promptly.
- Leave automatic minor updates switched on.
- Schedule major updates and plugin upgrades that touch checkout, forms or bookings on a staging copy first, with a rollback plan.
- Read changelogs and drop plugins that have gone quiet.
We have written up how to update WordPress safely with low downtime if you want the step-by-step version.
How do you keep plugins and themes under control?
Every plugin is code you did not write and cannot fully see. Fewer plugins mean fewer doors. Our guide to common WordPress security issues covers what goes wrong when this is ignored.
- Delete, rather than deactivate, any plugin or theme you do not use.
- Check update frequency, support replies and the author’s track record before installing.
- Prefer small, single-purpose plugins over giant bundles.
- Never install nulled or pirated premium copies. They are a favourite hiding place for malware.
- Scan for known vulnerabilities regularly and act as soon as one is reported.
How should you back up WordPress, and why test the restore?
A backup you have never restored is a hope, not a plan. The NCSC points out that backups are a critical dependency and that attackers may target them, so check integrity before you restore anything. It also stresses that restores must be tested and copies kept apart from the primary environment, otherwise your backup shares a single point of failure with your site.
- Automate backups and keep several versions, not just the latest.
- Store at least one copy outside your hosting account.
- Aim for a 3-2-1 pattern: three copies, two kinds of storage, one isolated.
- Restore to a test site on a schedule and write the steps down.
- Protect online backup storage with two-step verification, as the NCSC’s small organisations guide advises.
Pro Tip: Time your first test restore. Knowing it takes 40 minutes, not 4 hours, changes how you handle a bad day.
Our small business backup strategy goes deeper on the 3-2-1 approach.
What should your host and firewall be doing for you?
The cheapest attack to stop is the one that never reaches WordPress. Check your host and put protection at the edge.
- Ask your host about account isolation, a server-level firewall and managed patching.
- Enable an edge WAF or CDN, and use its bot management and login protections.
- Rate-limit wp-login.php and xmlrpc.php, the two endpoints bots hammer hardest. If you do not use XML-RPC, disable it.
- Enforce HTTPS everywhere and add HSTS once you are confident nothing breaks.
- Lock down wp-config.php, keep database credentials unique and switch off the dashboard file editor.
This is also where choosing a decent host pays off. For a sense of how a vendor can describe its own approach, Eventist’s security and data page is a useful reference.
How do you spot and recover from an incident?
You cannot fix what you do not see. Turn on audit logs for failed logins, file changes and plugin activity, then set alerts so a person actually gets told.
- Record critical assets: the domain, DNS, hosting, email and payment tools.
- Keep a contact list for your host, IT support and anyone who handles legal or PR, stored somewhere you can reach if email is down.
- Rehearse a restore drill so the team knows the steps.
- When something is wrong, isolate the site, restore from a validated backup and write down what you learned.
The NCSC’s small business guidance says response and recovery plans should identify critical assets and list external contacts that stay reachable when normal communications fail.
Planning beats improvising: the NCSC’s preparation step says to identify critical information and processes, write the plan down and exercise it.
What matters more than perfect protection?
Nobody gets perfect security, and chasing it burns time better spent elsewhere. The WordPress security white paper is candid that sound defences depend on using core APIs and configuring servers properly, not on any single magic fix. In my view, routine updates and a backup you have restored are worth more than any plugin you can buy. If you are busy running a business, hand the routine to someone reliable, and review this list regularly.
— Chris
Want us to run this checklist for you?
Most owners we work with do not want another job, so we do it for them. Our WordPress maintenance plan costs £30 per month per site. If you also want the server side handled, our UK web hosting starts from £15 per month. We are a small, locally based Derbyshire team, so you speak to the people doing the work, with unlimited content changes and clear pricing. Have a look at the maintenance page and tell us about your site.
FAQ
How often should I update my WordPress site?
Install security releases as soon as they appear, and check for plugin and theme updates at least weekly. WordPress advises updating immediately after a security release.
How often should I test my WordPress backups?
Test a restore regularly and after any major change. The NCSC recommends regularly testing restores, not just taking backups.
Do I really need two-factor authentication?
Yes, for every administrator and anyone who can publish or install code. It stops most stolen-password logins, and WordPress lists it among its main brute force defences.
What should I do first if my site is hacked?
Take the site offline or isolate it, tell your host, and restore from a backup you have checked is clean. Then change every password and review what let the attacker in.
Sources
Recommended
- Small Business WordPress: Update Safely with Low Downtime
- Small business WordPress backup strategy: 3‑2‑1 and restore tests
- Design 101, Website Security Overview
- Website Backups: Why They’re Important and How to Create Them
Related reading: WordPress maintenance plans for small businesses · Cloudflare for small business: practical setup guide · Microsoft 365 backup options
