The most important parts of a WordPress security checklist are keeping plugins, themes and core updated, protecting logins with strong passwords and two-factor authentication, running a firewall, and keeping tested off-site backups. Do those four well and you’ve blocked most of the attacks that actually take WordPress sites down.
WordPress runs a huge share of the web (W3Techs tracks the current figure), which makes it a constant target for automated attacks. The good news is that most hacks aren’t clever. They exploit an outdated plugin, a weak password or a login page that allows unlimited guesses. This checklist covers the fixes, in priority order.
Why WordPress security matters in 2026
Most WordPress vulnerabilities are found in plugins, not in WordPress core. Security researchers such as Patchstack publish yearly reports showing the same pattern, along with how quickly attackers start exploiting a flaw once it’s made public, often within hours or days.
That changes how you should think about security:
- Updating once a month isn’t enough for sites with many plugins.
- Automatic updates and virtual patching (a firewall blocking a known flaw before you update) matter more than ever.
- Backups are your safety net for when something gets through anyway.
A hacked site can lose traffic and customer trust fast. Google may show a warning in search results or in Chrome, and cleanup takes time.
The essential WordPress security checklist
1. Use one reputable security plugin
A security plugin brings login protection, malware scanning, firewall rules and vulnerability alerts into one dashboard. Well-known options include Wordfence, Solid Security, Sucuri Security and MalCare.
Choose one main security plugin. Stacking several with overlapping features causes conflicts, slows your site and can leave gaps. Don’t rely on the defaults either: turn on file-change monitoring and email alerts so you know when something changes.
2. Enforce strong authentication
Brute-force login attacks are cheap and automated. Protect logins in layers:
- Unique, strong passwords. Never use “admin” as a username. Store passwords in a password manager.
- Two-factor authentication (2FA) for every administrator and editor. Passkeys offer even stronger protection against phishing.
- Limit login attempts so an IP is locked out after a few failed tries.
- Least privilege. Give each user only the role they need. A contributor doesn’t need editor access, and an editor doesn’t need admin rights.
- Review users regularly and delete old accounts from former staff or developers.
3. Use SSL and force HTTPS
An SSL certificate encrypts data between your site and visitors, including passwords and form entries. Most hosts offer free Let’s Encrypt certificates.
Installing the certificate isn’t enough on its own. Make sure every page redirects from HTTP to HTTPS, and fix any mixed-content warnings. If you’re changing URLs, set up proper 301 redirects in WordPress so you don’t lose rankings.
4. Harden your login page and key files
- Rename or protect
/wp-login.phpwith your security plugin, or add a CAPTCHA. - Disable file editing in the dashboard by adding this to
wp-config.php:
define( 'DISALLOW_FILE_EDIT', true );- Disable XML-RPC if you don’t use it (for example for the Jetpack app or remote publishing). It’s a common brute-force target.
- Set safe file permissions: usually 755 for folders, 644 for files, and 600 or 640 for
wp-config.php. Check your host’s recommendation. - Change the default
wp_database prefix on new installs.
5. Use a web application firewall (WAF)
A WAF filters malicious traffic before it reaches your site. There are two kinds:
- Plugin-level WAF (for example Wordfence): runs on your server.
- Cloud or DNS-level WAF (for example Cloudflare or Sucuri): blocks attacks before they reach your server, and often speeds up your site too.
A good WAF can also apply virtual patches, which block known plugin vulnerabilities before you’ve had time to update.
6. Add HTTP security headers
Security headers tell browsers how to handle your site safely. Start with:
| Header | What it does |
|---|---|
Strict-Transport-Security | Forces HTTPS on every visit |
X-Content-Type-Options: nosniff | Stops browsers from guessing file types |
X-Frame-Options or CSP frame-ancestors | Prevents clickjacking |
Referrer-Policy | Controls what URL data is shared with other sites |
Content-Security-Policy | Limits where scripts and styles can load from |
Permissions-Policy | Restricts camera, microphone, location, etc. |
You can add them through your host, Cloudflare, .htaccess or a plugin. Test the result with a free header scanner. Introduce Content-Security-Policy carefully, because a strict policy can break scripts.
7. Keep a strict update routine
- Enable automatic updates for minor core releases and for trusted plugins.
- Check for updates at least weekly, more often on busy sites.
- Delete plugins and themes you don’t use. Deactivated code can still be exploited.
- Replace abandoned plugins, meaning ones that haven’t been updated in a long time or have been removed from the WordPress.org directory.
- Keep PHP up to date. Old PHP versions stop getting security fixes. Your host’s control panel usually lets you switch.
- Test major updates on a staging site first if your host offers one.
If you’d rather hand this off, see what WordPress maintenance services typically include.
8. Back up off-site and test your restores
- Back up files and the database automatically, daily for active sites.
- Store copies off your server, for example in cloud storage or a separate backup service.
- Keep several restore points, not just the latest one.
- Test a restore every few months. A backup you’ve never restored is a guess, not a plan.
9. Monitor for malware and suspicious changes
- Run regular malware scans.
- Turn on file-change alerts and an activity log so you can see who changed what.
- Add your site to Google Search Console and check the Security issues report.
- Use uptime monitoring so you hear about problems before your visitors do.
WordPress security checklist at a glance
| How often | Task |
|---|---|
| Once | SSL + HTTPS redirect, 2FA, WAF, security headers, disable file editing, remove “admin” user |
| Daily | Automatic backups, malware scan, uptime check |
| Weekly | Review and apply updates, check security alerts |
| Monthly | Review users and roles, delete unused plugins/themes, check the PHP version |
| Quarterly | Test a backup restore, review security headers and firewall rules |
What to do if your WordPress site gets hacked
- Don’t panic, and don’t delete everything. You may need the evidence to find how attackers got in.
- Put the site in maintenance mode if it’s redirecting visitors or showing spam.
- Change every password: WordPress admins, hosting, FTP/SFTP, database and email.
- Scan and clean with your security plugin, or hire a professional cleanup service.
- Restore a clean backup from before the hack if cleanup isn’t possible.
- Update everything and remove the vulnerable plugin or theme that let them in.
- Check Search Console for security warnings, then request a review once the site is clean.
- Monitor closely for a few weeks, because reinfections are common if the entry point wasn’t fixed.
If your rankings dropped after a hack, our guide on how to recover from a Google penalty walks through getting back on track.
How much does WordPress security cost?
It depends on how much help you need. Typical tiers:
| Tier | What you get | Good for |
|---|---|---|
| Free | Free security plugin, Cloudflare free plan, host backups, Let’s Encrypt SSL | Small blogs, personal sites |
| Premium plugin | Real-time firewall rules, advanced scanning, priority alerts | Business sites, small stores |
| Managed security | Cloud WAF, malware cleanup, incident response, expert support | Ecommerce, agencies, high-traffic sites |
Prices change often, so check each provider’s official pricing page before you buy.
FAQ
What is the most important WordPress security step?
Keeping plugins, themes and core updated. Outdated plugins are the most common way WordPress sites get hacked.
Can I secure WordPress for free?
Yes, to a good level. A free security plugin, Cloudflare’s free plan, strong passwords with 2FA, regular updates and free SSL cover the basics. Paid tools add faster firewall rules, cleanup and support.
Do I need a security plugin if my host provides security?
Often yes. Host security usually protects the server, while a plugin adds site-level protection like login limits, file-change alerts and malware scans. Check what your host covers so you don’t double up.
What should I do if my WordPress site gets hacked?
Change all passwords, scan and clean the site or restore a clean backup, update everything, remove the vulnerable plugin, and check Google Search Console for security warnings.
How often should I back up my WordPress site?
Daily for sites that change often, such as stores, blogs and membership sites. Weekly may be enough for small sites that rarely change. Always keep copies off your server.
Final thoughts
WordPress security isn’t one plugin or one setting. It’s a routine. Update often, protect logins, add a firewall and security headers, back up off-site and test restores. Use the checklist table above as your schedule and you’ll stay ahead of most of the attacks that take sites down.
A secure site is also a faster, more trustworthy one, so pair this with our guide on how to speed up WordPress and our list of common technical SEO mistakes.
Need help securing your WordPress site? Get in touch with our team today.
Saurabh K. has been working in SEO and digital marketing for 10+ years, helping businesses grow their search traffic.
