WordPress Security Checklist: 15 Steps to Protect Your Site
WordPress is secure when it is maintained properly. Most hacked WordPress sites we clean up have the same causes: outdated plugins, abandoned themes, weak passwords and cheap hosting. Use this checklist to protect your business website.
Updates and software
1. Keep WordPress core updated
Core updates often include security fixes. Apply them promptly, ideally after testing on a staging site for larger updates.
2. Update themes and plugins
Vulnerabilities in plugins are the most common entry point for attacks. Update regularly and watch for security notices.
3. Remove unused plugins and themes
Deactivated plugins can still be exploited. If you are not using it, delete it.
4. Only install reputable plugins
Choose plugins that are actively maintained, widely used and well reviewed. Avoid “nulled” premium plugins from unofficial sources, which often contain malware.
Logins and access
5. Use strong, unique passwords
Every admin account should have a long, unique password stored in a password manager.
6. Enable two-factor authentication
Two-factor login stops most brute-force and stolen-password attacks.
7. Limit administrator accounts
Give users the lowest role they need. Not everyone needs to be an administrator.
8. Limit login attempts
Block repeated failed logins to slow down automated attacks.
Hosting and server
9. Choose secure hosting
Reputable managed hosting includes server-level firewalls, malware scanning, isolated accounts and current software versions.
10. Use HTTPS everywhere
An SSL certificate encrypts data between visitors and your site and is expected by browsers and search engines.
11. Add a web application firewall
A firewall filters malicious traffic before it reaches WordPress.
12. Harden file permissions and configuration
Restrict file permissions, disable file editing from the dashboard and protect sensitive files such as wp-config.php.
Backups and monitoring
13. Take automatic off-site backups
Daily backups stored separately from your server let you recover quickly from hacks, bad updates or mistakes. Test restores occasionally.
14. Monitor uptime and changes
Monitoring tools alert you when the site goes down or files change unexpectedly.
15. Scan regularly for malware
Regular scans catch infections early, before they damage your reputation or get your site flagged by Google.
If your site has already been hacked
Do not panic, and do not simply restore an old backup without finding the cause. The vulnerability needs to be fixed, malware and backdoors removed, passwords reset and the site checked in Google Search Console for security warnings.
Let us handle it
JNova’s WordPress development and managed hosting services include security hardening, updates, backups and monitoring, so you can focus on your business. Read more about choosing hosting in our managed vs shared hosting guide.