WordPress Security Checklist: 15 Steps to Protect Your Website

WordPress itself is secure when it is maintained well. Most hacked WordPress sites are caused by outdated plugins, weak passwords or pirated themes. This checklist covers the steps that prevent the vast majority of problems.

Accounts and logins

1. Use a unique, strong password for every admin account, stored in a password manager.
2. Turn on two-factor authentication (2FA) for administrators.
3. Do not use "admin" as a username.
4. Give each person their own account with the lowest role they need (Editor, Author, etc.).
5. Limit login attempts to slow down password-guessing bots.

Updates

1. Keep WordPress core, themes and plugins updated.
2. Delete themes and plugins you do not use — even deactivated ones can be a risk.
3. Only install plugins and themes from reputable sources. Never use nulled or pirated premium plugins.

Backups

1. Schedule automatic backups of files and database.
2. Store backups off the server (for example, in cloud storage).
3. Test a restore at least once so you know it works.

Server and site settings

1. Use HTTPS across the whole site.
2. Use a supported PHP version from your host.
3. Disable file editing in the dashboard by adding this line to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

Monitoring

1. Use a security plugin or your host's scanner to monitor for malware and file changes, and set up uptime monitoring so you know quickly if the site goes down.

If your site gets hacked

• Do not panic — change all passwords (WordPress, hosting, database, email).
• Restore a clean backup from before the hack.
• Update everything and remove unknown admin users and suspicious plugins.
• Ask your host for help; many offer malware cleaning.
• Check Google Search Console for security warnings and request a review once clean.

Tip: Put a monthly "maintenance hour" in your calendar: update, back up, check forms and review users. Regular small maintenance prevents big emergencies.

Choosing plugins safely

Before installing a plugin, check when it was last updated, how many active installations it has, its reviews and whether the developer responds to support questions. A plugin that has not been updated for a long time may not be compatible with current WordPress versions or may contain unfixed vulnerabilities.

User roles explained

• Administrator — full control. Keep this to as few people as possible.
• Editor — can publish and manage all posts and pages.
• Author — can publish and manage their own posts.
• Contributor — can write posts but not publish them.
• Subscriber — can only manage their profile.

Giving people the lowest role they need limits damage if an account is ever compromised.

Your monthly security routine

1. Take or confirm a fresh backup.
2. Update WordPress core, themes and plugins.
3. Remove unused plugins, themes and user accounts.
4. Review security scan results.
5. Test the contact form and key pages.
6. Check Google Search Console for security issues.

Security for client websites

If you build sites for clients, agree in writing who is responsible for updates and backups after launch. Many freelancers offer a monthly maintenance plan — it protects the client and creates steady income.