WordPress security is a little like home security: one lock is helpful, but leaving every window open while hanging a neon “Welcome, burglars” sign over the garage is not ideal. The good news is that securing a WordPress site does not require a black hoodie, six monitors, or a dramatic keyboard montage.
It requires a practical system. Strong logins, clean plugins, dependable backups, smart hosting choices, and regular monitoring work together to reduce risk. No website is invincible, but a well-hardened WordPress site is far less attractive to opportunistic attackers hunting for an easy target.
This WordPress security checklist walks through 20 realistic steps to protect your website, customer data, content, rankings, and sanity. Start with the basics, apply the more technical safeguards carefully, and remember that security is a habitnot a button you press once and forget until something starts redirecting visitors to suspicious miracle-weight-loss ads.
Why WordPress Security Matters
WordPress is flexible, popular, and powerful. Those are excellent qualities for publishers, store owners, agencies, bloggers, and businesses. They also mean attackers frequently look for poorly maintained sites, outdated plugins, weak passwords, exposed login pages, and sloppy server settings.
Most WordPress compromises are not the result of movie-style hacking genius. They come from ordinary gaps: an abandoned plugin, a reused password, a former contractor whose account still has administrator privileges, or a backup that exists only in someone’s imagination.
The goal is not perfection. The goal is to make your site harder to break into, easier to restore, and faster to investigate when something looks strange.
20 Steps to Secure Your WordPress Site
1. Keep WordPress Core Updated
WordPress core updates often include security fixes, stability improvements, and compatibility changes. Delaying updates for months is like receiving a recall notice for your car and deciding the dashboard warning light adds character.
Turn on automatic minor security updates where appropriate, and schedule a regular review for major WordPress releases. Before applying large updates on a business-critical site, test them on a staging environment or make a fresh backup first.
2. Update Plugins and Themes Promptly
Plugins and themes are among the most common sources of WordPress security problems because they add code, features, and possible vulnerabilities to your site. Update active plugins and themes regularly, especially when a release includes a security patch.
Do not forget inactive themes. If you are not using them, remove them. Keep one current default WordPress theme as a fallback, then delete the digital attic full of old themes you installed in 2019 and never visited again.
3. Use Only Trusted Plugins and Themes
Install plugins and themes from reputable developers, the official WordPress repository, established marketplaces, or trusted vendors. Before installing anything, check when it was last updated, whether it supports your WordPress version, how responsive the developer is, and whether the feature is truly necessary.
A plugin that promises to “add 47 powerful features with one click” may sound exciting. So does adopting a raccoon. Both decisions deserve a pause.
4. Delete What You Do Not Use
Every unused plugin, theme, user account, API key, and integration expands your attack surface. Deactivating a plugin is not the same as removing it. If the code remains on the server, it can still become outdated or vulnerable.
Review your site quarterly. Remove unused plugins, old themes, demo content, stale staging copies, abandoned forms, and integrations that no longer serve a real business purpose.
5. Create Strong, Unique Passwords
Never reuse your WordPress password for email, hosting, social media, or another website. A password leak elsewhere can become a WordPress breach if the same credentials are reused.
Use a password manager to generate long, unique passwords for every account. A memorable phrase can work too, but avoid predictable details such as your company name, pet name, birthday, or “Password123!”a password so famous it deserves its own museum exhibit.
6. Enable Multi-Factor Authentication
Multi-factor authentication adds another verification step after a password, such as a code from an authenticator app or a physical security key. This makes stolen passwords much less useful to attackers.
Require multi-factor authentication for administrators, editors, shop managers, developers, and anyone with access to customer data or financial settings. Secure your hosting account and primary business email with multi-factor authentication too. A protected WordPress dashboard does not help much if the attacker can reset everything through your email inbox.
7. Limit Administrator Accounts
Administrator access should be rare. Give each person the lowest WordPress role needed to do their job. Writers usually need Author or Contributor access. Content managers may need Editor access. Most people do not need permission to install plugins, modify themes, or change user roles.
Use separate named accounts instead of shared logins. When everyone signs in as “Admin Team,” no one knows who changed the checkout page at 2:17 a.m.
8. Remove Former Employees and Contractors
When a freelancer, agency, employee, or vendor stops working with you, remove or downgrade their access immediately. Review WordPress users, hosting users, SFTP accounts, database accounts, payment service permissions, and third-party marketing tools.
Security offboarding should be part of your normal departure checklist, right alongside returning equipment and pretending everyone understands the shared drive folder structure.
9. Protect the Login Page From Brute-Force Attacks
Brute-force attacks repeatedly try usernames and passwords until something works. Use login rate limiting, failed-login lockouts, bot detection, or a reputable security plugin that blocks suspicious attempts.
Changing the login URL may reduce noisy automated traffic, but it is not a complete security solution. Treat it as a small speed bump, not a concrete bunker. Strong passwords, multi-factor authentication, and login throttling do the heavier lifting.
10. Use HTTPS Everywhere
HTTPS encrypts data traveling between visitors and your website. It is essential for login pages, forms, checkout pages, member areas, and any site handling personal information.
Install a valid SSL/TLS certificate, redirect all HTTP traffic to HTTPS, and check for mixed-content warnings caused by insecure images, scripts, or embedded files. For WordPress administration, consider enforcing secure admin sessions in your configuration.
Apply configuration changes carefully, especially if your site uses a reverse proxy, content delivery network, or complex hosting setup.
11. Harden Your wp-config.php File
Your wp-config.php file contains important settings, including database connection details and security keys. Protect it with appropriate server permissions, keep it out of public view, and avoid casually sharing it through email or chat.
Make sure your WordPress security keys and salts are long and random. Updating them can sign users out of active sessions, which is usually a helpful cleanup step after a suspected compromise or when access changes significantly.
12. Set Safe File Permissions
File permissions control who can read, write, and execute files on your server. Incorrect permissions can let attackers modify files or expose sensitive configuration data.
Many standard Linux-based WordPress setups use permissions similar to 644 for files and 755 for directories, but hosting environments vary. Avoid using 777 permissions unless your hosting provider gives a very specific, temporary reason. “Everyone can write to everything” is not a security strategy; it is a group project gone wrong.
13. Disable Dashboard File Editing
WordPress allows administrators to edit theme and plugin files from the dashboard by default. Disabling this feature can limit the damage if an administrator account is compromised.
This does not replace proper access control or malware protection, but it removes one convenient path an attacker might use after gaining dashboard access.
14. Add a Web Application Firewall
A web application firewall, often called a WAF, filters suspicious traffic before it reaches your site. A quality firewall can help block malicious requests, brute-force attempts, bad bots, common exploit patterns, and some denial-of-service traffic.
You can use a WordPress security plugin with firewall features, a cloud-based WAF, or a managed hosting provider with built-in protection. Choose one approach that fits your budget and technical comfort level instead of stacking three security plugins that argue with each other like reality-show contestants.
15. Scan for Malware and Monitor File Changes
Security scanning helps detect malware, unexpected file changes, vulnerable components, suspicious administrator activity, and known malicious patterns. Set scans to run regularly and make sure alerts go to an email address someone actually checks.
For more advanced sites, file-integrity monitoring can alert you when core files, themes, or plugins change unexpectedly. Developers with server access can also verify WordPress core files against official checksums.
16. Back Up Files and the Database
A complete WordPress backup includes both website files and the database. Files include themes, plugins, uploads, configuration files, and custom code. The database contains posts, pages, users, settings, comments, and much of the content that makes the site function.
Use automated backups, store copies offsite, and keep multiple restore points. For a frequently updated ecommerce site, daily or more frequent backups may be appropriate. For a small brochure site, weekly backups may be enough.
Most importantly, test restoration. A backup you have never restored is not a backup plan. It is a hopeful zip file.
17. Secure Hosting, SFTP, SSH, and Database Access
WordPress security extends beyond the dashboard. Choose a hosting provider that supports current PHP versions, server updates, backups, malware response, secure access methods, and account isolation where possible.
Use SFTP or SSH instead of plain FTP. Restrict database credentials to only the permissions your site needs. Remove old hosting users and rotate credentials after a team member leaves or after a security incident.
18. Review XML-RPC, REST API, Forms, and Uploads
Do not disable WordPress features blindly. XML-RPC may be unnecessary for many sites and can be abused for brute-force or amplification attacks, but some mobile apps, integrations, and services may rely on it. Disable or restrict it only after checking what your site uses.
The WordPress REST API is important for block editor features and many plugins, so disabling it completely can break legitimate functionality. Instead, protect sensitive endpoints, enforce authentication for administrative actions, and review custom integrations carefully.
Also secure forms and uploads. Validate form input, use spam protection where needed, restrict allowed upload types, and make sure contact forms do not expose sensitive data in public notifications or error messages.
19. Add Security Headers Carefully
HTTP security headers can provide another layer of protection against issues such as clickjacking, content injection, and accidental information exposure. Useful options may include a Content Security Policy, X-Content-Type-Options, Referrer-Policy, and frame-embedding protections.
Test headers before enforcing them across a live site. A strict Content Security Policy can be excellent, but it can also break analytics, payment widgets, embedded videos, or page-builder scripts if configured carelessly. Security is helpful; a broken checkout page is not.
20. Create an Incident Response Plan
Even well-protected websites can face problems. Create a simple incident response plan before you need it. Record where backups are stored, who manages hosting, who has domain access, which security tools are installed, and who should be contacted if the site is compromised.
If something looks wrong, act quickly: put the site into maintenance mode if necessary, preserve logs, change passwords, rotate access keys, scan the site, restore from a known-clean backup when appropriate, and investigate the root cause before declaring victory.
WordPress Security Mistakes to Avoid
Some security habits sound useful but provide little real protection. Hiding the WordPress version, renaming the login page, changing the database prefix, or installing a pile of random “security booster” plugins should never replace updates, access control, backups, and monitoring.
Another common mistake is treating a firewall as a substitute for maintenance. A firewall can block many attacks, but it cannot reliably protect a vulnerable plugin forever. Patch quickly, remove unnecessary software, and review your site’s security posture on a schedule.
Finally, avoid making major security changes directly on a live site without a backup or a rollback plan. Security improvements should reduce stress, not create a 4 p.m. emergency because the payment gateway suddenly refuses to load.
Experience: What Maintaining WordPress Sites Teaches You About Security
Anyone who has managed WordPress sites for long enough eventually learns the same uncomfortable lesson: most security trouble starts quietly. It rarely begins with an alarming movie-style warning that says, “Hello, I am the hacker.” More often, it begins with a strange administrator account, an unfamiliar plugin, a customer asking why they received a spammy email, or a page that suddenly ranks for terms related to cryptocurrency, questionable pharmaceuticals, or both.
One of the most valuable lessons is that routine maintenance beats panic. A site owner who updates WordPress, reviews user accounts, checks backups, and watches security alerts every week is usually in a much stronger position than someone who installs a security plugin once and assumes the internet has been permanently defeated. Security tools are useful, but they work best when a real person pays attention to them.
Another lesson is that the weakest account often matters more than the strongest administrator password. A small business may have a carefully protected owner account, but a forgotten contractor login with administrator access can become the easy route in. That is why user reviews matter so much. Every account should belong to a real person, every person should have only the access they need, and every former collaborator should be removed promptly.
Backups are where theory meets reality. Many site owners confidently say, “My host handles backups.” Sometimes that is true. Sometimes the available backup is incomplete, too old, inaccessible during an emergency, or stored on the same system that was affected by the problem. The best experience is boring: automated backups run quietly, copies exist offsite, and a test restore confirms they work. The worst experience is discovering that a backup plugin saved only the database but not the uploads folder containing five years of product images.
There is also a practical balance between security and usability. Locking down every possible feature can make a site difficult to manage and can break important tools. For example, completely disabling the REST API may interfere with the block editor or connected services. Blocking all XML-RPC traffic may disrupt a legitimate integration. A well-managed WordPress security setup asks, “Do we need this feature?” before deciding whether to remove, restrict, or monitor it.
Finally, security is easier when responsibility is clear. Someone should own the update schedule. Someone should receive alerts. Someone should know where the domain, hosting, backups, and payment accounts live. When that responsibility is vague, small issues linger. When it is clear, even a serious issue becomes manageable because the team knows what to check first.
The strongest WordPress sites are not necessarily the ones with the most expensive tools. They are the ones maintained consistently by people who understand that prevention, detection, and recovery all matter. Keep the software clean, the accounts controlled, the backups tested, and the emergency plan close at hand. Your future self will appreciate the lack of midnight surprises.
Conclusion
Securing a WordPress site is not a single task. It is a repeatable process of keeping software current, controlling access, protecting logins, filtering malicious traffic, monitoring changes, and preparing for recovery.
Start with the highest-impact actions: update WordPress, remove unused software, use strong passwords and multi-factor authentication, back up your site, and add a reliable firewall or security monitoring solution. Then build from there. A few consistent habits can dramatically improve your WordPress security without turning website management into a full-time spy thriller.
Note: Make and verify a complete backup before changing WordPress configuration files, server permissions, security headers, hosting settings, or firewall rules.
