A solid WordPress security checklist is the difference between a quiet Tuesday and a full site rebuild. Over the past 10+ years, I’ve inherited more hacked WordPress sites than I can count — usually from a panicked client message that starts with “my site is showing weird ads” or “Google says my site is flagged as dangerous.” In almost every single case, the hack could have been prevented with a handful of basic precautions that take less than an hour to set up.
WordPress powers over 40% of the web, which makes it the single biggest target for automated bots scanning for easy break-ins. The good news is that most attacks aren’t sophisticated — they’re bots looking for the same handful of common mistakes. Fix those, and you eliminate the vast majority of your risk.
Here’s the exact WordPress security checklist I run through on every site I manage.
The Full WordPress Security Checklist
1. Keep Everything Updated — Core, Themes, and Plugins
This sounds obvious, but it’s still the #1 cause of hacks I see. Outdated plugins with known, published vulnerabilities are the easiest way into a WordPress site — attackers don’t need to find a new flaw, they just scan the web for sites still running the old, broken version.
Turn on automatic updates for minor WordPress core releases at minimum, and check your plugin list monthly. If a plugin hasn’t been updated in over a year, that’s a red flag — consider replacing it.
2. Use Strong, Unique Login Credentials
Never use “admin” as a username — it’s the first thing every brute-force bot tries. Set a custom username, and use a genuinely strong, unique password (a password manager makes this painless). If you’re still using a password you can type from memory, it’s probably not strong enough.
3. Enable Two-Factor Authentication
Even a strong password can be phished or leaked in a data breach elsewhere. Two-factor authentication (2FA) means a stolen password alone isn’t enough to get in — the attacker also needs a code from your phone. This single step blocks the vast majority of automated login attacks outright.
4. Limit Login Attempts
By default, WordPress lets bots try unlimited username/password combinations. A login-attempt limiter locks out an IP address after a handful of failed tries, which shuts down brute-force attacks before they get anywhere.
5. Install a Web Application Firewall (WAF)
A firewall sits in front of your site and filters out malicious traffic before it ever reaches WordPress — blocking known attack patterns, bad bots, and suspicious requests. This is one of the highest-leverage security additions you can make, since it protects against threats you haven’t even discovered yet.
6. Change Your Default Database Prefix
WordPress installs with wp_ as the default table prefix, and a lot of automated SQL injection attacks are written assuming that prefix. Changing it to something custom during setup (or migrating it on an existing site) removes an entire category of automated attacks that rely on guessing the default.
7. Disable File Editing from the Dashboard
By default, an admin can edit theme and plugin files directly from wp-admin. If an attacker ever gets into an account, this feature lets them inject malicious code with a few clicks. Disabling it closes that door — add define( ‘DISALLOW_FILE_EDIT’, true ); to your wp-config.php file.
8. Keep Regular, Automated Backups
Security measures reduce risk, but nothing makes you 100% unhackable. If the worst happens, a recent backup is the difference between a 10-minute restore and a full rebuild. Set up automated daily or weekly backups stored off-server (not just on the same hosting account), so a compromised site doesn’t take your backups down with it. Backups belong on every WordPress security checklist precisely because they’re the one step that saves you when everything else fails.
9. Use SSL (HTTPS) Everywhere
If your site still loads over http:// instead of https://, that’s an immediate red flag to visitors and search engines alike, and it means any data submitted through forms travels unencrypted. Most hosts offer free SSL certificates now — there’s no reason not to have this in place.
10. Remove Unused Plugins and Themes Entirely
Deactivating a plugin isn’t enough — an inactive plugin’s files are often still sitting on your server and can still be exploited. If you’re not using it, delete it completely rather than just switching it off.
11. Restrict File Permissions
Incorrect file and folder permissions can let attackers write or execute malicious scripts on your server. As a general rule, folders should be set to 755 and files to 644 — anything more permissive than that is worth reviewing with your host.
What to Do If You Think You’ve Already Been Hacked
If you’re reading this because something already looks off — strange redirects, unfamiliar admin accounts, or a Google “this site may be hacked” warning — stop making changes yourself and get a proper cleanup done first. A rushed fix can sometimes make forensic cleanup harder, and some malware reinstalls itself through a backdoor you haven’t found yet.
Final Thoughts
None of these steps require advanced technical skill, and together they close off the entry points that cause the vast majority of WordPress hacks I see. Security isn’t about becoming unhackable — it’s about not being the easiest target on the internet, and this WordPress security checklist gets you there.
Not sure if your site is actually covered on all of these, or think you might already be compromised? Get in touch and I’ll run a full security audit and lock it down for you.