Many attacks on business websites are automated. Bots scan the web for known weak spots, such as an outdated plugin, a guessable password or an old admin account, and they hit whatever is easiest. When it works, you pay for it in downtime, lost leads, browser warnings and a cleanup bill.
The good news: a secure WordPress site comes mostly from routine habits, not expensive tools. Keep software updated, lock down logins, remove what you don’t use, keep tested backups, and know what to do when something goes wrong. This checklist is for founders and marketing or operations leads who own a WordPress site but aren’t security specialists. Each item is checked against the official WordPress hardening guide.
The checklist at a glance
| Area | Key actions | How often |
|---|---|---|
| Updates | Core, plugins, themes, PHP version | Weekly |
| Accounts and logins | Unique passwords, 2FA, least privilege | Quarterly user review |
| Plugins and themes | Delete unused, trusted sources, no file editor | Quarterly audit |
| Backups | Files and database, off-site, encrypted | Daily or weekly; test restores quarterly |
| Hosting and HTTPS | HTTPS everywhere, SFTP, separate database user | Yearly or on a host change |
| File permissions | 755 folders, 644 files, locked wp-config.php | After installs and migrations |
| Monitoring | Logs, file changes, uptime, Search Console | Alerts daily, review monthly |
| Incident response | Written plan, contacts, clean backup | Yearly walkthrough |
1. Updates
Updates close security holes that are already public, which is exactly what automated bots look for. The hardening guide is direct about it: keep WordPress on the latest version, keep plugins updated, and only ever download WordPress from wordpress.org. Automatic background updates have been part of core since version 3.7, so leave them on for minor releases.
- Check plugin and theme updates at least weekly. For simple, low-risk plugins, switch on auto-updates from the Plugins screen.
- For a store or a site with heavy custom code, test major updates on a staging copy first, then apply them to the live site.
- Ask your host which PHP version the site runs and move to one that still receives security fixes.
- Replace any plugin that is no longer maintained or has been closed in the WordPress.org directory.
If nobody on your team has time for this every week, our guide to WordPress maintenance services explains what a good plan covers. Ongoing WordPress maintenance and support is also one of our services.
2. Accounts and logins
Strong, unique passwords
The hardening guide warns against dictionary words, short passwords, and passwords made only of numbers or only of letters, and recommends a password generator. In practice, give the whole team a password manager and never reuse a password from another service.
Two-factor authentication
Two-factor authentication (2FA) asks for a second proof of identity after the password, usually a code from an app on your phone. The WordPress documentation on two-step authentication points to plugins in the WordPress.org directory to add it.
- Require 2FA for every Administrator and Editor at minimum.
- Prefer an authenticator app over text messages. The same documentation notes that SMS is not a secure communication channel.
- Store backup codes somewhere safe so a lost phone doesn’t lock out your only admin.
Least privilege
Least privilege means each person gets only the access they need. WordPress has built-in roles for this: Administrator, Editor, Author, Contributor and Subscriber.
- A blog writer usually needs Author. A marketing lead managing pages may need Editor. Very few people need Administrator.
- Don’t use “admin” or “webmaster” as an administrator username, as the hardening guide advises.
- Remove accounts for former staff, freelancers and agencies the day their work ends.
- Apply the same rule to the hosting panel, SFTP and database access.
3. Plugins and themes hygiene
Every plugin is someone else’s code running inside your site, so fewer plugins means less to update and less to go wrong.
- Delete what you don’t use. The hardening guide says it plainly: “if you are not using a specific plugin, delete it from the system.” A deactivated plugin is still on the server. Do the same with old themes.
- Install only from the WordPress.org directory or well-known vendors. Never use “nulled” (pirated) copies of paid plugins, because you can’t know what code was added.
- Turn off the built-in code editor by adding
define( 'DISALLOW_FILE_EDIT', true );to wp-config.php. It won’t stop every attack, but it removes an easy route for someone with a stolen admin login. - Avoid plugins that let admins run PHP code from the dashboard. Put custom code in a child theme or a small custom plugin instead.
A plugin audit often helps speed too, which is why it also appears in our guide to fixing a slow WordPress site.
4. Backups
The hardening guide recommends backing up regularly, including the database, keeping snapshots of the full installation so you have copies from before any compromise, and encrypting those backups.
- Back up both the files and the database.
- Store copies away from the web server, in a separate account. A backup on the same hosting account can be deleted or infected along with the site.
- Keep several versions going back a few weeks, since a hack is not always noticed on day one.
- Match frequency to how often the site changes: daily for a store taking orders, weekly for a brochure site, and always before major updates.
- Test a restore on a staging copy every quarter. An untested backup is a guess.
5. Hosting and HTTPS
- Serve the whole site over HTTPS with a valid certificate. The hardening guide specifically calls for an encrypted connection for administration.
- Use SFTP instead of FTP, which sends passwords in plain text.
- On shared servers, give each site its own database and database user.
- Pick a host that isolates accounts from each other, supports current PHP versions, offers a web application firewall (WAF, a filter that blocks common attack patterns before they reach WordPress), and lets you restore backups yourself.
If you switch hosts, plan it like any migration: our checklist for migrating a website without losing SEO covers the steps.
6. File permissions
File permissions control who can read and change files on the server. If they are too loose, anyone who gets a foothold can write almost anywhere. The hardening guide gives this baseline:
- Folders: 755
- Files: 644
- wp-config.php: readable only by you and the web server, which usually means 400 or 440
- Core folders (/wp-admin/, /wp-includes/) and the plugins folder: writable only by your user account
Never set anything to 777 to “fix” an upload error. Ask your developer or host to recheck permissions after a migration or a manual install, since both can reset them.
7. Monitoring
“Logs are your best friend when it comes to understanding what is happening with your website,” as the hardening guide puts it.
- Know where your server and access logs live, and keep them for a few weeks.
- Watch for file changes. Comparing files against a known-good copy, for example with Git, shows exactly what changed and when.
- Set up uptime alerts that go to a shared inbox, not one person’s phone.
- Add the site to Google Search Console and check its security issues report. A security warning in search results can undo months of SEO work.
- Get alerted when a new administrator account appears. The official FAQ on hacked sites lists unauthorized new users as a clear sign of a hack.
8. Incident response basics
Write a one-page plan before you need it: your host’s support contact, who has admin access, where backups live, and who makes decisions. If you are hacked, the WordPress FAQ suggests roughly this order:
- Document what you see, when you noticed it, and any recent changes.
- Contact your host, since on shared hosting the problem may reach beyond your site. Also scan the computers of anyone with admin access, because stolen logins sometimes start there.
- Reset all access: WordPress users (administrators first), the hosting panel, SFTP and the database. Replace the secret keys in wp-config.php to log everyone out.
- Take a snapshot of the infected site before cleaning, for reference.
- Restore a backup from before the compromise, or reinstall the same WordPress version from a trusted source and check files such as .htaccess and your theme files.
- Update everything, then change all passwords again once the site is clean.
- Work out how the attacker got in so the same gap can’t be used twice.
Common mistakes
- Treating one security plugin as the whole plan. It can’t patch an abandoned plugin or restore a site that has no backup.
- Deactivating plugins and themes instead of deleting them.
- Keeping backups only on the same server as the site.
- Sharing a single administrator login across the team.
- Leaving former agencies and freelancers with admin access.
- Changing passwords when the hack is found, but not again after cleanup.
Keep it on a schedule
For a business site, WordPress security is mostly a calendar: updates weekly, user and plugin reviews quarterly, backups tested, and a written plan for a bad day. None of it is complicated, but it only works when it is clearly someone’s job.
If you’d rather not own that in-house, Vynix provides WordPress development, maintenance and support as an ongoing service. Tell us about your site through our contact page and we can talk through where it stands today.