If your business runs on a WordPress site, its security isn’t an IT footnote — it’s the difference between a normal Tuesday and a week spent cleaning up an attack. The good news is that most of what keeps a site safe is boring, repeatable, and well understood. This WordPress security checklist walks through it in plain language, from the basics you can do this afternoon to the standing protection that runs quietly in the background. Work through it top to bottom, and you’ll close the doors attackers actually use.
We’ve organized it the way we’d actually tackle a site: logins first, then the things that let attacks in, then the safety nets, then the ongoing work. At the end, we’ll be honest about which parts are genuinely hands-on and which ones a managed host simply takes off your plate.
1. Lock down how people log in
The front door is the login screen, and it’s where a huge share of attacks start. Tighten it first:
- Use strong, unique passwords for every admin account — never a password you’ve reused anywhere else.
- Turn on two-factor authentication (2FA) for admin and editor accounts. A stolen password alone shouldn’t be enough to get in.
- Avoid the “admin” username. A predictable username is half of an attacker’s guess already done for them.
- Check for breached passwords. Credentials leaked in other companies’ breaches get sprayed at WordPress logins constantly. Blocking known-breached passwords shuts that down before it starts.
- Limit and slow down login attempts so automated guessing gets throttled rather than running unlimited.
Brute-force and credential-stuffing attempts are relentless and automated, which is exactly why this belongs at the top. We go deeper on that specific threat in WordPress brute-force and login protection explained.
2. Keep everything updated — this is the big one
If you do only one thing on this list, do this. As of 2026, security researchers consistently estimate that around 56% of WordPress hacks trace back to vulnerable plugins and themes — outdated code with a fix already published that simply wasn’t applied in time. Updating isn’t housekeeping; it’s the single highest-leverage security task you have.
- Update WordPress itself, plugins, and themes promptly whenever fixes ship.
- Delete anything you don’t use. Inactive plugins and themes still carry vulnerabilities. Inactive doesn’t mean harmless — it means unwatched.
- Only install plugins and themes from reputable sources, and check that they’re actively maintained before you rely on them.
- Verify the site after every update. Updates occasionally break layouts or features, so confirm the site still looks and works right rather than assuming.
That last point matters more than it looks. Applying updates blind trades one risk for another, which is why “applied and verified” is the standard worth holding your host to.
3. Reduce your attack surface
Every account, plugin, and open pathway is one more thing to defend. Trim what you don’t need:
- Give each person the least access they need. Not everyone needs to be an administrator — most contributors can be authors or editors.
- Remove old user accounts for people who’ve moved on. Dormant accounts are a favorite way in.
- Keep your plugin count sensible. Fewer plugins means fewer moving parts to update and fewer places for a flaw to hide.
- Disable or lock down XML-RPC (an old remote-access feature) and other old back doors if you don’t need them — they’re common targets for automated abuse.
4. Put real protection in front of the site
Everything above hardens the site itself. This layer stops bad traffic before it ever reaches your WordPress install:
- A firewall out front. A layered firewall filters obviously malicious requests — the snooping for weak spots, the break-in attempts, the junk — before they touch your server.
- A shared list of known attackers. It means a computer caught attacking other sites is already blocked before it tries yours.
- Blocking junk bots and AI copycat bots to keep aggressive crawlers from hammering your site and copying your content.
- HTTPS everywhere, always valid. Auto-renewing SSL means the padlock never lapses. An expired certificate breaks trust and, on a store, breaks sales.
5. Have a safety net that actually works
Assume something will go wrong eventually, and make sure a bad day is just a restore:
- Back up daily, and keep it off-site. A backup on the same server as the site can be lost along with the site. Off-site is the point.
- Make sure backups are monitored. A backup you never test is a guess. It needs to actually be there when you reach for it.
- Scan for malware on an ongoing basis so an infection is caught early rather than discovered by a customer or by Google.
- Watch uptime so an outage is caught by monitoring, not by an email from a frustrated visitor.
6. Know your response plan before you need it
If the worst happens, calm and ordered beats panic. Know in advance where your backups are, who to contact, and the basic sequence: contain, scan, clean, close the way in, and restore your reputation with Google if you were flagged. We lay that out step by step in how to fix a hacked WordPress site so you’re not improvising during an emergency.
What a managed host handles for you
Here’s the honest part of this checklist. A determined business owner can do all of the above — but “can” and “will, every week, forever” are different things. The updates especially need to happen promptly and consistently, and most owners log in a few times a year, not a few times a week. That gap is exactly where sites drift months behind on security fixes without anyone realizing.
This is what managed hosting is for. On our plans, the standing items on this list run automatically. A layered firewall and a live list of known attackers stop bad traffic before it reaches you, ongoing malware scanning and removal and breached-password login defense work behind them, and updates to WordPress itself, plugins, and themes are applied and verified — with real before-and-after checks, so an update never quietly breaks the site. Off-site backups 3 times a day that we monitor, uptime monitoring, auto-renewing HTTPS, speed tuning, and fast worldwide delivery are included too. To be precise about what that is: it’s not 24/7 pixel-by-pixel visual surveillance — it’s real verification at the moment things actually break, which is when we touch the site.
If you’d rather not carry this checklist yourself, that’s the whole idea. If you’re still weighing whether a plugin can cover the gap, read do you need a WordPress security plugin? next — the answer depends a lot on what your host already does. And if you want to understand why sites get compromised in the first place, why WordPress sites get hacked is the companion to this piece.
Do the basics, and let the rest run itself
Security isn’t about one clever trick. It’s a short list of unglamorous habits done consistently — strong logins, prompt updates, a real firewall, and backups you can trust. Do the hands-on parts, and let a good host carry the standing ones. Take a look at our managed WordPress plans to see the whole checklist handled at one flat price, with support any hour when something feels off.