Most WordPress site owners think about security after something goes wrong. That’s too late. The numbers are stark: 11,334 new vulnerabilities were found in the WordPress ecosystem in 2025 — a 42% increase compared to 2024. More alarming still, the median time from vulnerability disclosure to mass exploitation is just 5 hours. By the time you read about a threat, bots may already be scanning your site for it.
The good news: approximately 90% of attacks are preventable through basic security hygiene. This checklist gives you exactly that — a clear, ordered set of actions to take before your site goes live. Work through it top to bottom and you’ll eliminate the vast majority of your attack surface before a single real visitor arrives.
Why WordPress Is a High-Value Target
WordPress powers 43.5% of the entire internet, making it the world’s largest target for hackers. That popularity is also a double-edged sword: the more widely a platform is adopted, the more time attackers spend developing tools and automated scanners specifically for it. Your site doesn’t need to be high-profile to get hit — bots don’t discriminate.
Here’s where the real risk lives: WordPress core is very secure — there were only 6 vulnerabilities in 2025. The risk comes from plugins (91% of vulnerabilities) and outdated installations. That means your choices about which plugins you install, and how you maintain them, matter far more than which version of WordPress core you’re running.
1. Choose a Secure Hosting Foundation
Security starts at the infrastructure layer, before you write a single line of code or install a single plugin. Choosing the right hosting provider is like building your house on solid ground — it sets the foundation for everything else. Look for a host that offers server-level firewalls, automatic malware scanning, isolated environments, and PHP version control.
Our WordPress hosting plans are configured with security in mind from the start — hardened PHP environments, automated backups, and proactive monitoring baked in. See our pricing to find a plan that fits your project.
2. Run the Latest PHP Version
Your PHP version is the runtime your entire WordPress installation depends on. Running an outdated version means running without security patches. As of mid-2026, the supported PHP versions are 8.3 and 8.4. PHP 8.2 received its last security patch in December 2025. PHP 8.3 is the safe baseline. Check your version under Tools → Site Health in the WordPress dashboard and upgrade before launch if you’re behind.
3. Update Everything — Core, Plugins, and Themes
Updates may be the most critical security measure you can take to keep your WordPress site safe. They’re also easy to install and free. Before launch, make sure WordPress core, every active plugin, and every active theme is on its latest version.
Then audit what you actually need. Delete any plugins or themes you are not using — deactivated plugins still represent attack surface. If a plugin is installed but switched off, it can still be probed and exploited. If you don’t need it, remove it entirely.
Be selective about what you install in the first place. If a plugin or theme hasn’t been updated in ages or has been officially abandoned, it’s time to show it the door. Outdated or deprecated plugins aren’t just clutter — they’re potential security hazards waiting to happen. Only install plugins from WordPress.org or verified developers, and check the update history and active install count before committing.
4. Change the Default Admin Username
The username “admin” is one of the first usernames bad actors try in a brute-force attack. If you use this username it halves the effort they need to go through to guess the correct credentials. WordPress doesn’t allow direct username changes, so your best course of action is to create a new admin user and then delete the old one. Choose something non-obvious — not your name, not your site name.
5. Enforce Strong Passwords and Enable Two-Factor Authentication
A strong, unique password on the admin account is non-negotiable. Use a password manager to generate and store a random 20+ character string. Then go further: enable two-factor authentication (2FA) for every user with administrative or editor-level access. Even if a password is compromised, 2FA stops an attacker from completing the login. Plugins like WP 2FA or those bundled with security suites like Solid Security make this straightforward to deploy.
6. Install an SSL Certificate and Force HTTPS
An SSL certificate encrypts traffic between your server and your visitors’ browsers. In 2025, it’s a baseline expectation — not an optional extra. Without it, browsers mark your site as “Not Secure,” which kills user trust and hurts SEO before you’ve published a word.
Once your certificate is installed, force HTTPS site-wide. In WordPress, update Settings → General so both the WordPress Address and Site Address use https://. Then add a redirect rule in your .htaccess file or via your host’s control panel to catch any http:// requests:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]7. Add a Web Application Firewall (WAF)
A WAF filters malicious traffic before it reaches your WordPress site. This creates an invisible security barrier that most attackers never realize exists. A WAF can block brute-force login attempts, SQL injection, cross-site scripting (XSS), and bad bot traffic automatically.
XSS (cross-site scripting) accounts for 47.7% of all vulnerabilities in the WordPress ecosystem, and 43% can be exploited without any authentication — meaning a visitor doesn’t even need to log in for their browser to be weaponized against your site. A WAF stops these attempts before they reach your application layer. Wordfence and Cloudflare are two well-established options; many managed hosts include a WAF at the server level.
8. Add HTTP Security Headers
Security headers are instructions your server sends to the browser that activate protective policies. Without them, your visitors’ browsers have no guidance on how to handle cross-origin requests, clickjacking attempts, or MIME-type sniffing attacks.
Add these to your .htaccess or server configuration before launch:
- Content-Security-Policy (CSP) — controls which resources the browser is allowed to load
- X-Frame-Options: SAMEORIGIN — prevents your pages from being embedded in iframes on other domains (clickjacking defence)
- X-Content-Type-Options: nosniff — stops MIME-type sniffing attacks
- Strict-Transport-Security (HSTS) — forces browsers to use HTTPS for future visits
- Referrer-Policy — controls how much referrer information is passed with requests
Use securityheaders.com to scan your site and get a graded report before going live.
9. Lock Down File Permissions
Incorrect file permissions are one of the most overlooked misconfigurations on new WordPress installs. The correct baseline settings are:
- Directories:
755 - Files:
644 wp-config.php:440or400— restrict this file as tightly as possible
The wp-config.php file contains your database credentials and secret keys. Tightening its permissions and blocking direct web access to it via .htaccess is a quick win that many pre-launch checklists skip.
10. Configure Automated Off-Site Backups — and Test a Restore
A backup stored on the same server as your WordPress installation is not a real backup. If the server is compromised, the backup goes with it. Set up automated backups to a remote destination — a separate cloud storage bucket, a third-party service, or your local machine — and schedule them to run daily at minimum.
Critically, test a restore before launch. A backup you’ve never restored is a backup you’ve never verified. Knowing your restore process works before a crisis is the difference between a recoverable incident and a total loss.
11. Disable XML-RPC If You Don’t Need It
WordPress’s XML-RPC interface was designed for remote publishing tools but is now a common target for brute-force and DDoS amplification attacks. If you’re not using a tool that requires it (like the Jetpack module or the WordPress mobile app), disable it entirely. Add this to your .htaccess:
# Disable XML-RPC
<Files xmlrpc.php>
Order Deny,Allow
Deny from all
</Files>12. Run a Vulnerability Scan Before Going Live
Security vulnerability scanners can identify potential weaknesses in your website’s code and configuration. While not a foolproof solution, these tools are valuable assets in your security arsenal. Run a scan with a tool like WPScan, Sucuri SiteCheck, or the built-in scanner in your security plugin before you flip the switch. Fix everything flagged as high or critical before launch.
Security Is Ongoing, Not a One-Time Task
Security is an ongoing process. Stay vigilant, keep your software updated, and adapt your defenses as new threats emerge. After launch, set a weekly reminder to check for plugin and theme updates, review your activity logs, and verify your backup jobs ran successfully.
The cost of prevention is minimal compared to the cost of recovery. Recovery cost for a small business averages $14,500, versus approximately $8/month for proactive protection. That math is hard to argue with.
Want a Secure WordPress Site From Day One?
If you’d rather not manage this yourself, our managed WordPress hosting handles hardening, updates, automated backups, and monitoring for you — so you can focus on building your site, not defending it. Our web development team can also perform a full pre-launch security audit on an existing build. Contact us to talk through your project and we’ll recommend the right setup for your needs.