WordPress Security Hardening Checklist
WordPress core is actively maintained and reasonably secure. Most hacked WordPress sites are compromised through outdated plugins and themes, weak or reused passwords, and poorly configured hosting. This WordPress security checklist covers the controls we apply to business sites, grouped so you can assign each area to an owner and work through it in an afternoon or two.
Security is layered: no single plugin protects a site on its own. The goal is to make attacks harder, limit the damage if one succeeds, and recover quickly.
Why WordPress Sites Get Hacked
WordPress sites are usually attacked by automated bots, not targeted hackers. Bots scan the web for known plugin vulnerabilities, try common passwords against login pages and look for exposed files. Because the attacks are automated, small sites are hit just as often as large ones. The common entry points map closely to the risks listed in the OWASP Top 10: vulnerable components, broken authentication, injection and security misconfiguration.
| Attack vector | Typical cause | Main defense |
|---|---|---|
| Vulnerable plugin or theme | Updates ignored, abandoned or nulled plugins | Patch management and plugin hygiene |
| Brute-force or credential stuffing | Weak or reused passwords, no 2FA | Strong passwords, 2FA, rate limiting |
| Compromised hosting account | Shared hosting, FTP, leaked credentials | Isolated hosting, SFTP/SSH keys, least privilege |
| Malicious file upload | Insecure forms or plugins | File type validation, no PHP execution in uploads |
| Database injection | Poorly written custom code | Prepared statements, code review, WAF |
1. Updates and Plugin Hygiene
Keeping everything updated is the single most effective security control for WordPress. Most successful attacks exploit vulnerabilities that already have a patch.
- Keep WordPress core updated. Minor security releases install automatically by default; apply major releases after testing on staging.
- Update plugins and themes weekly, or enable auto-updates for low-risk plugins.
- Remove inactive plugins and themes entirely. Deactivated code can still be exploited if its files are reachable.
- Avoid plugins that have not been updated in over a year or have closed support threads, and never install “nulled” premium plugins, which frequently contain backdoors.
- Subscribe to a vulnerability feed (WPScan, Patchstack or Wordfence Intelligence) so you hear about issues in your plugins quickly.
2. Logins, Users and Authentication
Locking down accounts stops brute-force and credential-stuffing attacks, which run against almost every WordPress login page.
- Enforce two-factor authentication for every administrator and editor.
- Require long, unique passwords and encourage a password manager.
- Limit login attempts and rate-limit
wp-login.phpat the server or WAF. - Apply least privilege: content writers should be Authors or Editors, not Administrators. Review user lists quarterly and remove ex-staff and old agency accounts.
- Avoid the username “admin” and make sure author archive URLs do not expose login names you would rather keep private.
- Disable XML-RPC if you do not use the mobile app, Jetpack or remote publishing, since it is often abused for brute-force attempts.
3. Server and Configuration Hardening
Hardening the server and wp-config.php limits what an attacker can do even after finding a weakness.
- Use HTTPS everywhere with HSTS enabled once you are sure every subdomain supports TLS.
- Disable the built-in file editor by adding
define( 'DISALLOW_FILE_EDIT', true );towp-config.php, so a stolen admin login cannot edit PHP files from the dashboard. - Set correct file permissions: typically 755 for directories, 644 for files and tighter permissions such as 440 or 400 for
wp-config.php, depending on how your server runs PHP. - Block PHP execution in the uploads folder, since uploads should contain media only.
- Use unique security keys and salts in
wp-config.php, and rotate them after any suspected breach to force all sessions to log out. - Turn off debug output on production so error messages do not reveal file paths.
- Use SFTP or SSH keys rather than plain FTP, and give the database user only the privileges WordPress needs.
- Add security headers such as Content-Security-Policy, X-Content-Type-Options and Referrer-Policy.
4. Firewall and Malware Protection
A web application firewall (WAF) filters malicious requests before they reach WordPress, and malware scanning catches what gets through.
- Put the site behind a cloud WAF or CDN with managed WordPress rules. Edge firewalls stop traffic before it consumes server resources.
- Add an application-level security plugin for malware scanning and file integrity checks, but avoid running several overlapping security plugins.
- Block access to sensitive files such as
wp-config.php,.gitfolders, backup archives andreadme.html. - Protect forms with CAPTCHA or honeypot fields and validate file uploads by type and size.
5. Backups and Recovery
Backups are what turn a hack from a disaster into an inconvenience. Follow the 3-2-1 approach: three copies, on two types of storage, with one off-site.
- Back up files and the database daily, and more often for WooCommerce stores with frequent orders.
- Store backups off the web server, in a separate cloud account the site cannot write over.
- Keep at least 30 days of history, because infections often go unnoticed for weeks.
- Test a full restore to staging every quarter. An untested backup is a guess.
6. Monitoring, Logging and Privacy
Monitoring tells you something is wrong before customers or search engines do.
- Enable an activity log that records logins, user changes, plugin installs and settings edits.
- Set up uptime monitoring and alerts for unexpected file changes.
- Watch Google Search Console for security issue and manual action notices.
- If you collect personal data through forms or WooCommerce, minimize what you store and set retention periods. Under laws such as the GDPR, a breach involving personal data may need to be reported to a regulator within 72 hours.
Who Owns Each Part of the Checklist?
Security tasks slip when nobody owns them. Assign each area explicitly, even on a small team:
| Area | Typical owner | Frequency |
|---|---|---|
| Core, plugin and theme updates | Developer or maintenance provider | Weekly |
| User accounts and 2FA | Site administrator | Quarterly review |
| Server hardening and WAF rules | Hosting provider or DevOps | On setup, then quarterly |
| Backups and restore tests | Developer or host | Daily backups, quarterly test |
| Activity log and alerts | Site administrator | Weekly review |
What to Do If Your WordPress Site Is Hacked
Act quickly and in order: contain, clean, then close the hole that let the attacker in.
- Put the site in maintenance mode and take a snapshot of the infected state for investigation.
- Change all passwords: WordPress users, hosting, database, SFTP and any API keys stored on the server.
- Restore from a clean backup, or reinstall core, themes and plugins from official sources and clean the database.
- Find and patch the entry point, rotate salts, then request a review in Search Console if Google flagged the site.
Frequently Asked Questions
Is WordPress secure enough for a business website?
Yes. WordPress core has a dedicated security team and regular releases. Risk comes mainly from plugins, configuration and maintenance, which is why a disciplined WordPress security checklist matters more than the platform choice.
Do I need a security plugin?
One reputable security plugin is useful for malware scanning, login protection and activity logs. Pair it with server hardening and a cloud firewall rather than relying on the plugin alone.
Does changing the login URL improve security?
It reduces bot noise in your logs but is not a real security control. Two-factor authentication and rate limiting do far more.
How often should a WordPress site be audited?
Run through this checklist at least quarterly, and after any major change such as a redesign, new plugin or new hosting provider.
Get Help Hardening Your WordPress Site
Sigmato’s WordPress development team audits, hardens and maintains business sites and WooCommerce stores. Security work fits well alongside WordPress speed optimization, and if you are planning a new build, our WordPress cost and timeline guide shows how to budget for maintenance. For broader guidance on protecting customer data, see our data privacy and security checklist.
Sources and References
