The WordPress security checklist

Why does WordPress security depend more on your habits than anything else?

Most WordPress hacks don't happen through complex bugs or advanced attacks, but through the simplest mistakes: weak passwords, outdated plugins, and neglecting sensitive files. If you want to take your WordPress site's security seriously, you first need to know where an attacker gets in, and then close those paths in order of priority.

In this article, I've prepared a practical, prioritized checklist for WordPress security. Each section includes clear instructions, real examples, and warnings about common mistakes. You don't have to do everything at once—start with the first section and work your way through in order.

Priority One: Locking Down Entry Points with Passwords and Authentication

More than 80% of successful WordPress attacks happen through the login page (wp-login.php). Attackers use brute-force attacks (password guessing) or credentials leaked from other sites to try to get into the dashboard. So the first step in WordPress security is hardening this very point.

Strong, Enforced Passwords for All Users

The site admin password should be at least 14 characters long and include a mix of uppercase letters, lowercase letters, numbers, and symbols. To generate a secure password, you can use tools like LastPass or Bitwarden. You can also enforce strong passwords by default in the wp-config.php file:

define('WP_AUTO_UPDATE_CORE', true);
// Disable file editing from the dashboard
define('DISALLOW_FILE_EDIT', true);

Important note: If your site has multiple authors, be sure to review roles. Give users who only publish posts the "Author" role, not "Admin." Every role higher than needed is an added risk.

Limiting Login Attempts (Login Lockdown)

Install a plugin like Limit Login Attempts Reloaded so that after 3 to 5 failed attempts, the IP address is locked out for 15 minutes. This effectively neutralizes brute-force attacks. Recommended settings:

• Maximum allowed attempts: 3
• Lockout duration: 15 minutes
• Lock based on IP and User-Agent

Common mistake: Many admins just install the plugin but leave the default settings. The default for these plugins is usually 20 allowed attempts, which is enough for an attacker. Be sure to lower the number.

Two-Factor Authentication (2FA) for Admins

If you only do one thing for WordPress security, do this: enable 2FA for all admin accounts. Install plugins like WP 2FA or Google Authenticator. With this in place, even if a password is leaked, an attacker can't get in without the one-time code.

Priority Two: Regular Updates for Core, Plugins, and Themes

Most successful hacks happen through known vulnerabilities in outdated plugins. Attackers scan sites, find old versions, and exploit common bugs. Updating is the simplest and most effective defensive measure.

Enabling Automatic Updates

Add this line to your wp-config.php file so the WordPress core updates automatically:

define('WP_AUTO_UPDATE_CORE', true);

For plugins and themes, go to the "Updates" section in the WordPress dashboard and enable the "Automatic Updates" option. If you're worried about compatibility, at least set a weekly reminder to check manually.

Removing Inactive Plugins and Themes

A plugin that is deactivated but not deleted can still be vulnerable. An attacker can use its files. Simple rule: if you're not using a plugin, delete it—don't just deactivate it.

Common mistake: Many admins keep old plugins installed that haven't been updated for years. If a plugin hasn't been updated in more than 6 months, it's likely abandoned, and you should find a replacement.

Priority Three: Protecting Sensitive Files and Folders

The wp-config.php file contains database connection credentials, and if it's exposed, the entire site is at risk. Also, the wp-content/uploads folder is where user files are uploaded, and you need to prevent script execution there.

Locking Down wp-config.php with htaccess

Add this code to the .htaccess file in your site's root to block access to the configuration file:

<Files wp-config.php>
Order Allow,Deny
Deny from all
</Files>

This causes any direct request to wp-config.php to receive a 403 error.

Preventing PHP Execution in the Uploads Folder

Create an .htaccess file in the wp-content/uploads folder and add this code:

<FilesMatch "\.(php|php5|phtml)$">
Deny from all
</FilesMatch>

This blocks malicious files uploaded through forms from being executed.

Disabling Error Display in Production

Add these settings to your wp-config.php file so PHP errors are not shown to users:

ini_set('display_errors', 0);
ini_set('log_errors', 1);
define('WP_DEBUG', false);

Displaying errors gives attackers valuable information about your site's structure.

Priority Four: Regular Backups and Restore Testing

No security is 100%. If your site gets hacked, the only way to recover is a clean backup. The backup should include both files and the database and be stored somewhere off the main server.

Recommended Backup Schedule

• Daily database backup (small size, fast)
• Weekly full file backup
• Keep the last 30 versions
• Automatic transfer to cloud storage like S3 or Google Drive

Plugins like UpdraftPlus or BackWPup automate this. Just make sure the backup destination isn't on the same server—if the server is hacked, the backup is lost too.

Monthly Restore Testing

A backup that has never been tested is worthless. Once a month, restore the backup in a test environment (like localhost or a subdomain) and make sure the site comes up clean. This takes 30 minutes but will save you hours on the day of an incident.

Priority Five: Firewall and Network-Level Protection

After closing direct entry points, it's time for network-level protection. A Web Application Firewall (WAF) can filter malicious traffic before it reaches WordPress.

Choosing a Firewall Solution

You have two options: a firewall plugin like Wordfence or Cloudflare as a CDN and firewall layer. If your site is on shared hosting, a plugin is the better choice. If you have a dedicated server or VPS, I recommend Cloudflare because it offloads processing from your server.

Recommended Cloudflare settings:

• Enable "Under Attack Mode" during an attack
• Enable Bot Fight Mode
• Set up Rate Limiting rules for the login page

If your site is hosted on cloud infrastructure, you can use security services provided by your hosting company like ServerNet, which typically include firewall and DDoS protection.

Regular Malware Scanning

Install a plugin like Wordfence and enable weekly scans. This plugin compares core files against the original versions and reports any unauthorized changes. If you see changes in core files, your site is infected.

Priority Six: Transport Layer and DNS Security

SSL and DNS are two layers that are often overlooked but play a major role in WordPress security.

Enabling SSL and Forcing HTTPS

Get a free SSL certificate from Let's Encrypt and add this code to your .htaccess file to force HTTPS:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

After enabling SSL, be sure to update your site URL in WordPress settings to use https://. Otherwise, you'll create a redirect loop.

Protecting DNS

If you're using your host's default DNS, make sure your account has a strong password and 2FA is enabled. DNS hijacking is one of the most dangerous attacks because an attacker can redirect your site's traffic to their own server.

Summary: WordPress Security Roadmap

WordPress security is a process, not a destination. Work through this checklist in order of priority:

1. Strong passwords and 2FA for all admins
2. Limit login attempts
3. Automatic updates for core, plugins, and themes
4. Lock down sensitive files and prevent PHP execution in uploads
5. Daily backups and monthly restore testing
6. Firewall and regular malware scanning
7. Forced SSL and DNS protection

If you just do the first three items today, you'll have closed 90% of the common entry paths. Complete the rest in the coming weeks. Remember: WordPress security isn't a one-day job, but with this checklist, you can dramatically reduce the risk of being hacked.