WordPress Security Checklist: 12 Steps to Protect Your Website

WordPress security feels like a dark art until you break it down into concrete steps. The good news is that most WordPress hacks are not sophisticated attacks. They are automated scans looking for easy targets: outdated plugins, weak passwords, missing backups. Fix those, and you remove most of the risk without becoming a security expert.

This guide is a practical checklist, not a theory lecture. It is written for business owners who run a WordPress site and want to protect it without spending every weekend reading security blogs. Each step tells you what to do, why it matters, and how much time it takes. Do them in order, and your website moves from easy target to hard target.

Quick takeaway: the cheapest security investment in WordPress is the pair “updates plus backups”. Everything else in this checklist makes you safer, but nothing beats keeping your software current and knowing you can restore your site in minutes.

Why Small WordPress Sites Get Hacked

It helps to understand who is attacking you and why. Most small business sites are not targeted by name. They are caught by automated bots that scan the internet for vulnerabilities and try them against thousands of sites at once. Your site gets hacked not because someone wanted you specifically, but because it was running something exploitable.

Three causes account for the overwhelming majority of hacked WordPress sites. Outdated software is the first: vulnerabilities are found in plugins and themes every week, and patches are released quickly. Sites that do not update stay exposed. Weak credentials are the second: an admin password like a pet name or a business name is guessable, and login pages are attacked constantly. The third is missing backups: even with strong security, things go wrong, and sites without recent backups lose everything.

Keep those three in mind as you work through the checklist. They are the foundation everything else builds on.

The Complete WordPress Security Checklist

Here is the full checklist you will complete in this guide. Tick them off as you go and keep the list somewhere you can revisit it once a month.

1. Enable automatic updates for WordPress core, plugins and themes.
2. Use a strong, unique password and enable two-factor authentication.
3. Remove unused themes and plugins completely.
4. Change the default admin username if you still have one.
5. Install a security plugin and configure the essentials.
6. Add a web application firewall.
7. Limit login attempts and protect the login page.
8. Set up automated offsite backups with a restoration test.
9. Enable HTTPS with a valid SSL certificate.
10. Harden the database and file permissions.
11. Hide sensitive files like wp-config.php and disable file editing.
12. Monitor your site for malware and set up alerts.

That is twelve steps. In practice, steps one through eight take care of the vast majority of real-world risk. Steps nine through twelve are hardening that makes a good setup excellent.

Step 1: Turn On Automatic Updates

If you do nothing else from this guide, do this. WordPress can update itself automatically for minor releases, and modern versions of WordPress let you enable automatic updates for plugins and themes too. When a vulnerability is found, the developer releases a patch, and if your site updates itself, the vulnerability closes before the bots can exploit it.

To enable this in WordPress, go to the dashboard and open the updates page for plugins and themes. Many managed hosting providers enable automatic updates by default and even handle them for you. If your host offers managed WordPress, automatic updates are a checkbox you should never disable.

The common objection is fear that an update will break the site. It is a real concern, but the math favors updating: a broken layout after an update is fixed in minutes and costs you a support call, while a hacked site costs you downtime, cleanup and lost trust. Keep backups running, and the fear of updates mostly disappears.

Step 2: Strong Passwords and Two-Factor Authentication

The WordPress login page is the front door of your site, and it is under constant attack. Bots try thousands of username and password combinations every day against sites that are open to the internet. The two defenses that matter are a password that cannot be guessed and a second layer that works even if the password leaks.

Use a password manager and let it generate a long random password for your WordPress admin accounts. Do not reuse passwords across sites. If you manage several sites, or if you have more than one admin user, add two-factor authentication. A free plugin that generates a code on your phone turns a leaked password from a disaster into a non-event, because the attacker still cannot log in without the code on your device.

Also review your user list and delete accounts you no longer use, especially old accounts with admin or editor roles. Every extra account is an extra door.

Step 3: Remove What You Do Not Use

Every plugin and theme you install adds code to your site, and every piece of code is potential attack surface. Sites accumulate plugins over the years: one for a campaign, one for a feature that was abandoned, one that was replaced but never removed. Each of them gets updated, or does not, and each one that does not get updated is a risk.

Go through your plugin list and delete anything you are not actively using. Be honest about it. If a plugin has not been used in six months, remove it. Deactivating is not enough: an inactive plugin can still be a vulnerability, so delete it entirely. Do the same with themes. You only need the active theme, and one backup theme at most.

Step 4: Fix the Default Admin Username

Many WordPress sites were installed with a user called admin, and the username “admin” is the first thing every attacker guesses. If your admin account is still named admin, change it or, better, create a new administrator account with a normal-looking name, then remove the admin account.

This single step removes the biggest guessing shortcut for bots. Combined with a strong password and two-factor authentication, the login page stops being an easy target entirely.

Step 5: Install a Security Plugin and Configure the Basics

A good WordPress security plugin centralizes most of this checklist into one dashboard. Popular options include Wordfence, Sucuri, Solid Security and All in One Security. They all handle the same core jobs: login protection, security scanning, and often a firewall.

When you install one, configure at least these basics: enable the security scanner, set the frequency to daily, enable login security, and turn on email alerts for critical events. You do not need every feature on day one. Start with the defaults, let the scanner run, and add features as you understand them.

A note on cost: the free versions of these plugins cover the essentials well. Paid plans add real-time malware removal and premium support, which makes sense for sites that handle money or sensitive data.

Step 6: Add a Web Application Firewall

A web application firewall, or WAF, sits between your site and the internet and blocks malicious traffic before it reaches WordPress. Think of it as a bouncer at the door: it checks everyone coming in and turns away the known troublemakers. This is one of the most effective things you can do, because it stops attacks before they touch your software.

You have two options. A cloud-based firewall, like the one included in Cloudflare, filters traffic at the network level and is the strongest choice, since attackers never even reach your server. Or a plugin-based firewall, which runs on your server and is easier to set up. For most small businesses, starting with a cloud firewall on the free tier plus the firewall built into your security plugin is a solid, cost-effective setup.

Step 7: Limit Login Attempts and Protect the Login Page

Even with a strong password, brute-force attacks waste resources and can lock your site into a slow crawl. Limiting the number of login attempts per IP address stops this cold. After a few failed tries, the source is blocked for a set period. Most security plugins include this feature and it takes one setting to enable.

For extra protection, you can move the login page to a custom URL that bots do not scan, restrict login access by IP address if your team works from fixed locations, and add a CAPTCHA to the login form. These make automated attacks dramatically harder and cost you nothing but a few minutes of configuration.

Step 8: Automated Offsite Backups, with a Test

Backups are not strictly security, but they are the safety net that turns a security incident into an inconvenience instead of a catastrophe. The rule is simple: back up your entire site, database included, on a schedule, and store the backups somewhere separate from your hosting server.

A plugin like UpdraftPlus, BackupBuddy or a managed-hosting backup feature handles this for you. Set the schedule to at least daily for the database and weekly for the full site. Store backups in the cloud, on a different provider than your host, so a server failure does not take your backups with it.

Here is the step most people skip and it is the most important one: test a restore. Once a month, restore a backup into a staging environment and confirm your site works. A backup you have never tested is not a backup; it is a hope.

Step 9: Enable HTTPS Everywhere

HTTPS encrypts the data between your visitors and your site, and it is non-negotiable in 2026. Beyond protecting sensitive data like passwords and payment details, HTTPS is a ranking factor and browsers flag sites without it as not secure, which destroys trust before a visitor even reads your content.

If your site is not already on HTTPS, your hosting provider almost certainly offers a free SSL certificate, often through Let’s Encrypt, enabled with a single toggle. After enabling it, force all traffic to the HTTPS version of your site, so no one lands on an insecure copy.

Step 10: Harden the Database and File Permissions

Hardening is the technical layer that makes exploitation harder even when an attacker finds an opening. Two measures matter most. First, use a database prefix that is not the default wp_ in front of your table names. Many attacks assume the default prefix, so a custom one blocks a large class of automated attempts. You can change it with a plugin or a quick database update, and your security plugin can guide you through it.

Second, set correct file permissions. Your files should generally be read and written only by the owner, and your wp-config.php file should be protected from being read by other users. Your hosting provider’s documentation shows the recommended permissions, and a security plugin can flag anything out of line.

Step 11: Protect Sensitive Files and Disable File Editing

Your wp-config.php file contains your database credentials and secret keys. By default, it sits in the web root, and you want to make sure it cannot be served to the public. The standard hardening step is to move it one directory above the public web root, where the web server cannot reach it. If your setup allows that, do it; most managed hosts already do this for you.

Also disable the built-in file editor, the one in Appearance that lets you edit theme and plugin files from the dashboard. If an attacker gains admin access, the file editor gives them a direct path to inject malicious code. Disabling it forces them to work around an extra layer. You can disable it with one line added to your configuration file, and your security plugin can do it for you.

Step 12: Monitor for Malware and Set Up Alerts

Security is not a one-time project; it is a habit. The final step is to keep watching. Your security plugin’s scanner should run daily and compare your files against known-good versions, flagging anything modified. Some scans also check your site against known malware signatures and blocklists.

Set up alerts so you know immediately when something changes: a new admin user, a core file modified, a failed login surge. You do not need to read every alert, but you do need to know when something abnormal happens while it is still small. Most incidents are detected this way, not by the firewall, because the monitoring catches what the blocking missed.

How Much Does WordPress Security Cost

The table below summarizes what each layer costs, so you can plan without surprises.

Everything in the checklist is achievable for under 200 dollars a year, most of it for free. Compared with the cost of a hacked site, which regularly runs into thousands of dollars in cleanup, lost revenue and reputation damage, this is the cheapest insurance your business can buy.

What to Do Right Now

If you only have fifteen minutes today, do these four things. Enable automatic updates for everything. Change your admin password to a long random one and add two-factor authentication. Delete the plugins you do not use. Turn on daily backups and store them offsite.

That is the 80 percent of protection for 20 percent of the effort. Schedule the remaining steps over the next two weeks, put a monthly review in your calendar, and your WordPress site goes from being an easy target to one that attackers skip. In security, boring consistency beats occasional heroics every time.

Frequently Asked Questions

Is WordPress itself insecure?

WordPress core is actively maintained and reasonably secure. The vast majority of hacks come from outdated plugins and themes, weak passwords and missing backups. Keep those under control and WordPress is a safe platform for business websites.

Do I need a paid security plugin?

No, the free versions of major security plugins cover the essentials well, including scanning and login protection. Paid plans add real-time malware removal and priority support, which become worth it for sites handling money or large traffic.

How often should I check my website security?

Set up daily automated scanning and email alerts, review your security plugin’s report once a month, and run a manual backup restore test monthly. If you outsource your website, ask your provider for a monthly security summary.

What do I do if my site is hacked?

Do not panic and do not try to clean it by hand. Restore from your most recent clean backup, then change all passwords and update everything. After the restore, scan thoroughly to confirm the malware is gone, and find the vulnerability that let the attacker in so it does not happen again.

Should I hide the fact that I use WordPress?

Security through obscurity provides marginal value and hurts in other ways. Being on WordPress is not a weakness by itself. A site that is up to date, properly configured and well backed up is a hard target regardless of whether the platform is visible.

The Bottom Line

WordPress security is a checklist, not a mystery. Twelve steps, most of them free, a few minutes a month, and your website stops being an easy target. Start with updates, passwords and backups, then work through the rest at your own pace. The sites that get hacked are almost never the ones that did the boring work; they are the ones that assumed it could not happen to them.