The WordPress Security Checklist I Use on Every Site

This is the same checklist I run through on every site I take on, whether it’s day one of a new maintenance plan or a routine monthly pass. Nothing on it is exotic — WordPress security is mostly about doing a short list of unglamorous things consistently, not finding some clever trick nobody else knows. Bookmark it, run through it yourself, or use it to sanity-check whoever’s currently handling your site’s security.

Section 1: Prevention

Prevention is where almost all the value is. Everything in this section is cheap to do and expensive to skip.

• Keep core, themes, and plugins updated — on a tested, staged cadence, not left to pile up. Every security patch is a public disclosure of what’s vulnerable in sites that haven’t applied it yet. Here’s what happens if you don’t.
• Remove anything you’re not using. An inactive plugin or theme is still code sitting on your server. If you’re not using it, delete it — don’t just deactivate it.
• Use strong, unique admin credentials. Not “Password123,” not the same password reused from another site. A password manager makes this a non-issue.
• Enable two-factor authentication on every account with admin or editor access.
• Limit login attempts. Brute-force login attempts against `/wp-login.php` are constant background noise on the internet — rate-limiting or blocking repeated failures shuts most of it down automatically.
• Restrict file permissions so that, if something is compromised, it can’t rewrite core files or drop new ones anywhere it wants.
• Disable file editing from wp-admin (`DISALLOW_FILE_EDIT`), so a compromised admin account can’t be used to directly edit theme or plugin files from the dashboard.

Section 2: Detection

Prevention reduces how often something goes wrong. Detection is what determines whether you find out in five minutes or five months.

• Uptime monitoring. Something should tell you the moment your site goes down — not a customer, not a search engine ranking drop three weeks later.
• Malware and file-integrity scanning. Regular scans catch injected code, unexpected file changes, and known malware signatures before they escalate.
• Activity logging. A record of who logged in, what changed, and when — so if something does happen, you’re not reconstructing the timeline from guesswork.
• Watch for the obvious tells: unexpected admin users, unfamiliar plugins you didn’t install, a sudden spike in outbound traffic, search results showing content that isn’t actually on your pages.

Section 3: Recovery

This is the section people skip, and it’s the one that matters most when something actually goes wrong.

• Automated, offsite backups — not stored on the same server as the site itself, which does you no good if that server is the thing that’s compromised.
• Test the restore process, not just the backup. A backup file nobody has ever tried to restore from is a hope, not a plan. Here’s how to actually test one.
• Have a written incident plan, even a short one: who to contact, where the backups live, what the rollback steps are. Deciding this in the middle of an active incident costs time you don’t have.

If you’re dealing with an active compromise right now rather than planning ahead, the immediate steps are different enough that they deserve their own walkthrough — I’ve written that up separately so it’s easy to find in a hurry rather than buried in the middle of a checklist.

Frequently asked questions

What’s the single most important WordPress security step?

Keeping core, themes, and plugins updated. Every other item on this checklist reduces risk further, but skipping updates is the single most common way sites actually get compromised.

Do I need a security plugin if I already have good hosting?

Usually yes. Hosting-level protection covers the server; it doesn’t cover application-level things like weak admin passwords, vulnerable plugins, or activity logging inside WordPress itself. The two layers do different jobs.

How often should I run through this checklist?

Monthly is a reasonable baseline for most sites — that’s the cadence I use for a routine pass. Anything with elevated risk (ecommerce, membership sites handling sensitive data) benefits from more frequent monitoring, even if the full checklist stays monthly.

What should I do first if I think my site is already compromised?

Stop and isolate before you do anything else — here’s the exact order I work through, starting with maintenance mode and changing every password tied to the site.

Want this handled instead of DIY?

Everything on this list is exactly what’s covered on every tier of my WordPress maintenance and security service — I run it continuously so you don’t have to remember to. If you’d rather hand this off entirely, see the plans or get in touch and I’ll walk you through what’s already in place on your site today.