WordPress Security Hardening Checklist: 20 Steps for Business Websites

WordPress itself is well maintained, but most hacked WordPress sites have the same causes: outdated plugins, nulled themes, weak passwords and no backups. This WordPress security checklist covers the steps that matter for a typical business website.

Updates and software

1. Keep WordPress core updated (enable automatic minor updates at least)
2. Update plugins and themes weekly; remove ones you don't use
3. Avoid nulled/pirated themes and plugins; they often contain backdoors. See open source licences and nulled themes
4. Choose plugins with recent updates and many active installs
5. Run a supported PHP version (8.x)

Logins and users

6. Unique strong passwords for every admin; use a password manager
7. 2FA for all administrator accounts
8. Don't use "admin" as a username
9. Give staff the lowest role they need (Editor, Author), not Administrator
10. Limit login attempts. See brute force protection
11. Remove old users, especially former agencies and staff. See offboarding checklist

Configuration

12. Disable file editing in the dashboard: add define('DISALLOW_FILE_EDIT', true); to wp-config.php
13. Correct file permissions: typically 644 for files, 755 for folders, and stricter for wp-config.php
14. Block PHP execution in wp-content/uploads
15. Disable XML-RPC if you don't use apps or Jetpack features that need it
16. Use HTTPS everywhere. See SSL for every website
17. Change the default database table prefix on new installs

Protection and recovery

18. A firewall at the plugin level or via a service like Cloudflare. See WAF explained
19. Daily off-site backups with tested restores. See how to back up a website
20. Monitoring: uptime alerts, Search Console security alerts, file change notifications

Signs something is wrong

Unknown admin users, spam pages in Google, redirects on mobile. See website malware signs.

Do you need a security plugin?

A reputable security plugin can cover login limits, firewall rules and scanning in one place. Use one, not three; overlapping security plugins slow sites and conflict.

FAQs

Is WordPress less secure than a custom PHP site?

Not inherently. WordPress is attacked more because it's popular. A well-maintained WordPress site is safer than a neglected custom one.

How often should I check updates?

Weekly at least, and immediately for security releases.