The WordPress Security Checklist

The practical steps that keep a WordPress site from getting hacked - passwords, updates, backups, and more. A plain-English security checklist. Tick items off as you go - your progress saves in this browser.

1. All admin passwords are strong, unique, and different from other sites
2. Two-factor authentication is enabled for all admin accounts
3. WordPress core, theme, and all plugins are updated to latest versions
4. Unused plugins and themes are deleted - not just deactivated
5. File permissions are correct: files 644, folders 755
6. wp-config.php has security keys/salts and is not publicly accessible
7. Database prefix is not the default "wp_" (if possible)
8. XML-RPC is disabled if not needed (blocks brute-force attacks)
9. Login attempts are limited - security plugin or host-level protection
10. Admin username is NOT "admin" - use a custom username
11. SSL certificate is active and forces HTTPS site-wide
12. Backups are automated, off-site, and restore-tested
13. File integrity monitoring alerts you to unauthorized changes
14. Server-level firewall or WAF is active (host-provided or plugin)
15. User accounts are audited quarterly - remove anyone who shouldn't have access

Next checklist →