WordPress Security Checklist: How to Protect Your Site From Hacks
WORDPRESS · 10 MIN READ

WordPress Security Checklist: How to Protect Your Site From Hacks

Almost every hacked site I have cleaned up was running an outdated plugin or a password somebody could guess. The exotic attacks are rare. The boring ones are constant.

By Tariq Sallam·September 2026

WordPress itself is not insecure. The overwhelming majority of compromises come from three things: an outdated plugin, a weak password, and hosting shared with somebody who had one of the first two.

This checklist is ordered by how much risk each item removes. The first five take an hour and prevent most real attacks. The rest are worth doing and matter far less than people who sell security plugins would like you to believe.

Quick Info

Most common entry point
Outdated plugin or theme
Second
Weak or reused administrator password
Highest-return single action
Two-factor authentication on all admin accounts
Non-negotiable
Off-site automated backups you have tested restoring
What security plugins do not fix
Not updating
If you are hacked
Restore from a clean backup, then close the hole

1. Update everything, on a schedule

This is the whole answer, and it is the item most often skipped because it is dull. Known vulnerabilities in popular plugins get exploited within days of disclosure, at scale, by automated scanners that do not care how small your site is.

01Enable automatic updates for WordPress core minor releases.
02Enable automatic updates for plugins you trust to not break, which is most of them.
03Update the rest manually on a fixed schedule, weekly or fortnightly, with a backup taken first.
04Check the site afterwards. Not the dashboard, the actual front end.
05Delete plugins and themes you are not using. Inactive code is still exploitable.

No security plugin can protect a site running a plugin with a publicly documented vulnerability. The update is the security measure.

2. Fix the credentials

No account named admin, administrator or your domain name. Those are the usernames every bot tries first.
Long unique passwords from a password manager. Not a memorable phrase with a number on the end.
Two-factor authentication on every administrator account. This single measure stops brute force and credential stuffing outright.
One administrator account, or as few as the business needs. Everyone else gets editor or author.
Remove accounts for people who have left. Old contractor accounts are a standard entry route.

If you do only one thing from this entire article, turn on two-factor authentication. It removes the largest category of attack completely.

3. Limit login attempts

Rate limiting stops the automated password guessing that makes up most of the traffic hitting your login page. Any security plugin will do it, and so will most managed hosts at server level.

Changing the login URL is mild obscurity rather than security. It cuts the noise in your logs, which has some value, and it stops nobody determined.

4. Backups you have actually tested

Backups are not prevention, they are the reason a compromise is an afternoon rather than a catastrophe.

01Daily automated backups of files and database.
02Stored off-site, not on the same server as the site.
03Retained for at least thirty days, because malware often sits quietly for weeks before doing anything visible.
04Restorable by you, without a support ticket.
05Tested. Restore to a staging site once so you know the process and know the backup works.

An untested backup is a belief, not a plan. I have watched somebody discover their nightly backup had been failing silently for five months on the day they needed it.

5. Choose hosting that helps

On cheap shared hosting, a neighbour's compromise can become yours if account isolation is poor. Managed hosts add server-level firewalls, malware scanning and patching, which is a meaningful part of what you are paying for.

Account isolation on shared hosting.
A web application firewall at server level.
Automatic patching of PHP and server software.
A current PHP version. Old versions are unsupported and unpatched.
Free automatic SSL, universal now.

6. Sensible hardening

Worth doing, and secondary to the five items above.

Disable file editing in the dashboard, so a compromised login cannot immediately edit theme files.
Disable PHP execution in the uploads directory, a common route for uploaded shells.
Set correct file permissions: 644 for files, 755 for directories.
Disable XML-RPC unless something you use needs it.
Keep the WordPress version and plugin versions out of public page source where practical.

Most of these are single settings in a security plugin. Do not spend a weekend on them until updates, passwords and two-factor are done.

7. Monitor, so you find out early

Malware scanning, from your security plugin or your host, running daily.
Uptime monitoring, so you learn about downtime before a customer tells you.
File change alerts, which catch modifications you did not make.
Google Search Console, which will email you if Google detects malicious content. This is often the first warning people get.
Check your user list monthly for accounts you did not create.

8. If you are already hacked

Order matters here, and the mistake is cleaning without closing the hole, which produces a reinfection within days.

01Take the site offline or into maintenance mode if it is serving malware to visitors.
02Change every password: WordPress admins, hosting, database, FTP. Everyone.
03Restore from a backup predating the compromise, if you have one. This is faster and more reliable than manual cleaning.
04Identify the entry point: check plugin versions against known vulnerabilities, review file change logs, check for accounts you did not create.
05Update everything and delete the vulnerable component before bringing the site back.
06Scan again, then request a review in Search Console if Google flagged the site.
07Watch closely for two weeks. Reinfection means the hole is still open.

If the site handles customer data or payments, take proper advice on your notification obligations. That is a legal question rather than a technical one.

What does not help

Security plugins as a substitute for updates. They are a supplement.
Hiding your WordPress version. Attackers scan for vulnerable files directly.
Blocking countries by IP. Trivially bypassed and it blocks real visitors.
Renaming the login page and considering the job done.
Buying a premium security suite while leaving three plugins two years out of date.

Security is maintenance. The product you are looking for is a calendar reminder.

Frequently Asked Questions

Is WordPress secure?

Core WordPress is well maintained and audited. Sites get compromised through outdated plugins and themes, weak credentials and poor hosting, not through core itself.

Do I need a security plugin?

One is useful for firewall, scanning, login limiting and two-factor. It does not substitute for updates, which prevent far more incidents.

What is the single most effective thing I can do?

Two-factor authentication on every admin account, then keeping plugins updated. Those two remove the large majority of realistic risk.

How often should I back up?

Daily for a site that changes, and before every update. Off-site, retained thirty days, and tested at least once.

Why would anyone hack a small business site?

They are not targeting you. Automated scanners look for known vulnerabilities at scale and use whatever they find for spam, redirects or mining.

My site was hacked and cleaned. Why did it come back?

The entry point was never closed. Cleaning removes the symptom; updating or deleting the vulnerable plugin removes the cause.

Before You Go

Security on WordPress is unglamorous and largely solved: update on a schedule, use a password manager, turn on two-factor, back up off-site and test the restore. That is an hour of setup and fifteen minutes a month.

The rest of the checklist reduces risk at the margins. Do it after the boring part, not instead of it. The maintenance checklist turns this into a monthly routine.

Update, two-factor, back up. Then everything else.

WRITTEN BY TARIQ SALLAM
Marketing Consultant. Entrepreneur. Content Creator.

I'm a marketing consultant, entrepreneur and content creator. I help businesses grow through practical marketing, websites, SEO, content and AI.

More About Tariq →

Keep reading