WordPress Security Checklist: 10 Steps to Protect Your Site

The numbers are not reassuring. In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem — a 42% year-on-year increase — with roughly 13,000 sites hacked every single day and a median exploitation window of just five hours after a vulnerability is disclosed. That last figure is the one that should change how you think about maintenance windows.

With over 810 million websites powered by WordPress, representing 43% of all websites globally, the platform has become the primary target for cybercriminals seeking to exploit vulnerabilities and steal sensitive data. The good news: most of these disasters are preventable. The checklist below covers every layer — from login to server — in the order that gives you the most protection, fastest.

Step 1: Keep WordPress Core, Themes, and Plugins Updated

Keeping WordPress core, plugins, and themes updated is the single highest-impact habit you can build. It sounds obvious, yet it remains the top attack vector.

In 2025, 91% of vulnerabilities were in plugins, with only 6 found in WordPress core — and critically, 46% of vulnerabilities had no developer patch at the time of disclosure. That last point matters: patches often already exist before an attack happens, and it’s the delay in applying them that creates the damage.

• Enable automatic background updates for WordPress core minor releases.
• For plugins you trust — especially anything related to security, backups, or uptime monitoring — turn on auto-updates.
• If a plugin hasn’t been updated in over a year, it probably doesn’t belong on your site.

Step 2: Use Strong, Unique Passwords for Every Account

Nearly 8% of WordPress websites are hacked due to weak passwords. It is one of the most preventable attack vectors there is.

• Always create passwords with a mix of uppercase and lowercase letters, numbers, and special characters — aim for at least 12–16 characters.
• Every WordPress login, database, and hosting account should have its own unique password. Reusing one across multiple platforms increases vulnerability if any single one gets compromised.
• Never leave the default username as admin. Using “admin” as a username is one of the top reasons WordPress sites get hacked — simply changing it to anything else will protect your site from the majority of automated attacks.

Step 3: Enable Two-Factor Authentication (2FA)

Two-factor authentication adds an extra layer of login security beyond just a password. With 2FA enabled, a user must provide a secondary verification code in addition to their password — meaning even if someone cracks or steals your password, they still cannot access the admin dashboard without that second factor.

WordPress doesn’t include 2FA by default, but you can easily add it using plugins like WP 2FA or Google Authenticator. Teams that need to require 2FA by user role should use WP 2FA by Melapress. Sites already running Wordfence should turn on the 2FA that ships with it rather than adding a second plugin.

Apply 2FA to every account with administrator or editor access — not just the primary admin. Coordinate 2FA with hosting provider features like IP allow-listing, WAF, and hardened SSH access to create a true defense-in-depth posture.

Step 4: Harden Your Login Page

Your login page is one of the most targeted URLs on any WordPress site. Limiting login attempts, changing the default login URL, and adding CAPTCHA all reduce the volume of automated traffic hitting it.

According to Wordfence’s 2025 annual report, brute-force login attacks account for roughly 40% of all attempted breaches. Combine login attempt limits with CAPTCHA and a custom login URL and you will eliminate the vast majority of automated credential-stuffing bots before they ever try a single password.

• Install a plugin like Limit Login Attempts Reloaded or Wordfence to cap failed login attempts per IP.
• Change /wp-login.php to a custom URL using a plugin such as WPS Hide Login.
• Consider restricting access to the wp-admin dashboard via IP allowlisting for even tighter control.

Step 5: Install a Web Application Firewall (WAF)

A web application firewall (WAF) inspects all incoming traffic to your WordPress site, blocking malicious requests before they reach your web server. Think of it as a bouncer that never sleeps.

A WAF inspects incoming HTTP requests and blocks malicious patterns before they reach WordPress — acting as your first line of defense against SQL injection, cross-site scripting, and file inclusion attacks.

For most WordPress sites, a combination of Cloudflare (free tier) for DDoS protection and rate limiting, plus Wordfence (free) for application-level scanning, provides solid coverage without additional cost. Cloud-based WAFs have an added advantage: they operate at the DNS level, filtering malicious traffic before it ever reaches your server, reducing server load and providing protection even during sustained attack campaigns.

Step 6: Audit and Minimise Your Plugin and Theme Footprint

91% of WordPress vulnerabilities are in plugins. Every inactive plugin or theme sitting on your server is a potential entry point, whether or not it is switched on.

57% of vulnerabilities in H1 2025 required no authentication whatsoever — no login needed, no password to steal, just a vulnerable plugin installed and active.

• Deactivate and delete any plugin or theme you are not actively using.
• Only install plugins from the official WordPress.org repository or trusted commercial developers with active support histories.
• A single well-configured security plugin and WAF will cover more ground than a stack of overlapping tools. Monitor user activity and file changes regularly.

Step 7: Force HTTPS and Install an SSL Certificate

An SSL certificate encrypts all data transmitted between your visitors and your server, protecting login credentials, form submissions, and payment data from interception. Beyond security, Google treats HTTPS as a ranking signal — running HTTP in 2025 harms both your credibility and your SEO.

• Obtain a free certificate via Let’s Encrypt or use the one provided by your host (our hosting plans include free SSL).
• Force HTTPS site-wide via your wp-config.php or a plugin like Really Simple SSL.
• Set up a 301 redirect from all HTTP URLs to HTTPS and update your WordPress Address and Site Address settings accordingly.

Step 8: Set Correct File Permissions

Incorrect file permissions are a silent vulnerability that many site owners never check. If your files are world-writable, any user on a shared server — or any attacker who gains a foothold — can modify them freely.

• Directories should be set to 755.
• Files should be set to 644.
• wp-config.php — the most sensitive file on your installation — should be 440 or 400.
• Disable file editing from the WordPress dashboard by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.

Hardening is distinct from simply installing a security plugin. A security plugin adds monitoring and firewalls, but hardening changes the underlying configuration of WordPress, the web server, and the hosting environment. File permissions are a core part of that hardening layer.

Step 9: Run Regular Security Scans and Monitor for Changes

Attackers are now injecting code directly into legitimate WordPress core, plugin, and theme files rather than dropping standalone malicious files — meaning the traditional “scan and delete” approach to malware removal misses this entirely. Active monitoring is the only way to catch it early.

• Use Wordfence, Sucuri, or MalCare to schedule automated malware scans at least weekly.
• Enable file integrity monitoring so you are alerted the moment a core file changes unexpectedly.
• Review your WordPress user list regularly and remove any accounts you don’t recognise — attackers routinely create rogue admin accounts as backdoors.
• A reputable security plugin can detect malware, monitor file changes, and implement a web application firewall.

Step 10: Maintain Automated, Off-Site Backups

Regular backups are a lifesaver in case your site is hacked or crashes, allowing you to quickly restore a clean version. A backup stored only on the same server as your site is not a real backup — if the server is compromised, so is the backup.

• Use a plugin like UpdraftPlus, BlogVault, or Jetpack Backup to automate daily (or real-time) backups.
• Store backups in at least one off-site location: Amazon S3, Google Drive, Dropbox, or a dedicated remote server.
• Test your restore process periodically. A backup you’ve never restored is a backup you don’t trust.
• Store backups and access credentials securely, and ensure backup access requires 2FA if the backup system exposes a dashboard.

Bonus: Start With a Secure Hosting Environment

All ten steps above become significantly easier — and more effective — when your hosting environment is built with WordPress security in mind from the ground up. A secure hosting environment greatly reduces the chances of compromise. Look for a host that provides server-level firewalls, isolated account environments, automatic malware scanning, and PHP version management.

Our managed WordPress hosting is configured specifically for this. Isolation, daily backups, SSL, and server-level security are part of the baseline — not upsells. Check our pricing page to see what’s included at each tier.

Quick-Reference Checklist

1. Auto-update WordPress core, plugins, and themes; delete anything unused
2. Use 12–16 character unique passwords on every account; ditch the “admin” username
3. Enable 2FA for all admin and editor accounts
4. Limit login attempts, add CAPTCHA, and change your login URL
5. Deploy a WAF (Cloudflare + Wordfence is a solid free combo)
6. Remove inactive plugins and themes immediately
7. Force HTTPS site-wide with a valid SSL certificate
8. Set file permissions correctly; disable dashboard file editing
9. Schedule automated security scans and monitor file integrity
10. Keep automated, off-site backups and verify they restore cleanly

Security is not a one-time project. Maintaining a WordPress site is a continuous journey — security, performance, and reliability are interconnected pillars, and neglecting one can compromise the others. Work through this checklist now, schedule a review every quarter, and you will be ahead of the overwhelming majority of WordPress sites on the internet.

If you would rather have an expert handle the heavy lifting — hardening, monitoring, backups, and updates — contact us to discuss our managed WordPress hosting or web development services. We will audit your current setup and tell you exactly where the gaps are.