WordPress Security Checklist: 10 Steps in Priority Order

A WordPress security checklist should start with the things attackers actually use: outdated plugins, weak logins and too many administrators. Patch first, then lock down accounts with multi-factor authentication and least-privilege roles, then add backups, a web application firewall, file hardening and monitoring. Work in that order and you close the most common doors before you polish the rare ones.

Hardening means reducing a site’s attack surface by removing what you don’t need and restricting what remains. Most steps below come from the official Hardening WordPress guide; the order comes from where the vulnerability data says the risk sits.

Why does a WordPress site need a security checklist?

Because the plugin ecosystem adds new holes every year, and most site owners never see them. Patchstack’s State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up from 7,966 in 2024 according to its previous annual report.

Core is rarely the problem. The plugins and themes you add are, and nearly half of last year’s flaws had no fix when they went public.

What should a WordPress security checklist cover first?

Start with updates and account access, because that’s where the data above points. Here is the order I work in, built on the official hardening guidance:

1. Update core, plugins and themes, with auto-updates on.
2. Delete unused plugins and themes.
3. Require multi-factor authentication.
4. Give each user the lowest role they need.
5. Keep tested, off-site backups.
6. Put a web application firewall (WAF) in front.
7. Lock file permissions and disable the file editor.
8. Harden the login page.
9. Turn on logging and file-change monitoring.
10. Write down your recovery plan.

Steps one to four close the common entry points. Steps five to ten limit the damage when something gets through.

How fast should you apply WordPress updates?

Within hours for security releases, not at the next monthly maintenance window. Patchstack puts the weighted median time to first exploit at 5 hours after a vulnerability is disclosed, and its 2026 report found 46% of 2025 vulnerabilities had no fix in time for disclosure. Updating can’t fix a flaw that has no update yet, which is why the later steps exist.

Oliver Sild, CEO of Patchstack, made the trade-off plain on the WP Tavern podcast in March 2022, while discussing site owners who switch auto-updates off:

“It’s better to have a broken website because you can at least put the maintenance mode on and do something about that and fix it.”

I agree for most small business sites. A broken layout is a rollback. A hacked site is a cleanup, lost trust and lost leads. If you’re budgeting for ongoing patching, see my breakdown of website maintenance costs.

How do you clean up WordPress plugins and themes?

Delete anything you don’t actively use, then replace anything abandoned. Plugins carried 91% of new vulnerabilities and themes 9% in Patchstack’s 2025 data, so every add-on you remove is a stream of future patches you no longer need.

• Deactivated is not deleted. Its files stay on the server until you remove them.
• Check release dates. No update in a year deserves a closer look.
• Never install “nulled” plugins from unofficial sites.

Fewer moving parts is one reason I build some sites on another stack, as I explain in Next.js vs WordPress.

Is multi-factor authentication worth it on WordPress?

Yes, and it’s the cheapest control on this list. CISA’s guidance to require multifactor authentication says strong passwords “are no longer enough to keep accounts and systems safe when used alone.” It ranks security keys strongest and text or email codes weakest.

On WordPress, MFA comes from a plugin or from single sign-on. Require it for every Administrator and Editor, so a stolen password alone never opens your dashboard.

Which WordPress user roles should your team have?

Give each person the lowest role that still lets them do their job. WordPress has six pre-defined roles, per its Roles and Capabilities documentation. An Administrator has access to all the administration features within a single site, an Editor can publish and manage everyone’s posts, and an Author can publish and manage only their own.

Keep Administrator to one or two named people, never a shared login, and remove accounts the day someone leaves. Role design is a usability question too, which I cover in building a CMS your team will actually use.

How do you harden the WordPress login page?

Remove the easy wins for bots. The official Brute Force Attacks guide says “Do not use the username admin,” recommends rate-limiting login attempts at the WAF, CDN or web server, and advises disabling XML-RPC if you don’t use it.

Rate limits plus MFA do the job without the side effects of older tricks like password-protecting all of /wp-admin.

Do you still need backups and a firewall?

Yes, and neither replaces patching. The hardening guide says to “Back up your data regularly, including your MySQL databases,” and to install a WAF that filters content before WordPress processes it. Patchstack’s hosting test shows why a generic host firewall isn’t enough alone: only 26% of vulnerability attacks were blocked, and traditional defenses stopped just 12% of WordPress-specific ones.

Keep one backup copy off the hosting account, keep enough history to roll back past an infection, and test a full restore. An untested backup is a hope, not a plan.

Which file permissions and settings should you change?

Lock files down as far as the site still works. The official guide uses these values in its examples:

The guide calls the built-in file editor “often the first tool an attacker will use” after logging in, so turning it off is worth the minute it takes.

How do you know if a WordPress site has been hacked?

Usually through monitoring, not because a visitor tells you. The Hardening WordPress guide calls logs “your best friend” and recommends file-change monitoring and intrusion detection, because “Sometimes prevention is not enough and you may still be hacked.”

At minimum, set up uptime alerts, file integrity scanning and login logs stored off the site. Monitoring decides whether you find a problem in hours or in weeks.

How I help keep WordPress sites secure

I run this WordPress security checklist as part of my cybersecurity and hardening work: assess, harden, secure access, monitor, then respond on the NIST incident lifecycle if something does happen. My background includes SOC experience in threat hunting and incident response, and I’ve delivered 350+ projects across 8+ years of leading teams, with 99.9% uptime maintained.

I work on existing WordPress sites, so you don’t need a rebuild to get hardened. Ongoing updates and monitoring sit under web care and delivery, and if the plugin list is out of hand, my WordPress to Next.js migration playbook explains when moving makes sense. I’m based in Jacksonville, FL and support businesses in Jacksonville Beach, St. Augustine and across the US. Read more about me or see my case studies.

Frequently asked questions

How often should I review my WordPress security checklist?

Check for updates at least weekly, and apply security releases the day they land. Review users, plugins and backups once a month: delete accounts nobody uses, remove plugins you stopped needing and confirm the latest backup actually restores. Run the full list every quarter and after any big change, such as a redesign or a new developer. The monthly review catches the slow drift that creates most openings: the extra admin account, the abandoned plugin, the backup job that quietly stopped running.

Is a security plugin enough to protect a WordPress site?

No. A security plugin helps with scanning, login limits and alerts, but it runs inside WordPress, so it only sees a request after it reaches your site. Patchstack’s testing found traditional hosting defenses blocked only a small share of WordPress-specific attacks, which is why I pair a plugin with an edge firewall such as Cloudflare, fast updates and MFA. Treat the plugin as one layer, not the plan. Updates, fewer plugins and least-privilege accounts do more than any single tool.

Should I turn on automatic updates in WordPress?

For most small business sites, yes, at least for minor core releases and for plugins from well-maintained developers. Exploits often follow disclosure within hours, and a manual monthly routine leaves a long gap. The risk of auto-updates is a plugin conflict that breaks a layout or a form. You reduce that risk with daily backups, uptime monitoring and a quick check of key pages after updates run. For sites with custom code or checkout flows, test on a staging copy first, but keep that window short.

What should I do first if my WordPress site gets hacked?

Contain it before you clean it. Put the site into maintenance mode or take it offline, change every administrator password, remove unknown user accounts and rotate database and hosting credentials. Take a copy of the infected site before you restore anything, because you need to know how the attacker got in. Restore a clean backup dated before the infection, update everything and close the entry point. Then check Search Console for security warnings and request a review once the site is clean. If customer data may be involved, talk to a lawyer about your obligations.

Where should you start this week?

Start with updates and MFA today, then work down the list one step a week. If you’d rather have someone run the whole checklist and keep it running, get in touch and tell me what your site runs on.