Securing a WordPress site: the essential checklist

Most hacked WordPress sites are not compromised through a sophisticated flaw, but because a basic security point was neglected. Bots scan the web continuously looking for these weak spots: a small site is not spared because it is small. Here, in order of importance, is what to check, and how.

1. Updates, without exception

WordPress core, theme and plugins: every security update that gets published makes the fixed flaw public. A site that falls behind becomes an easy target, found automatically.

• Keep WordPress core’s automatic security updates on.
• Turn on automatic updates for simple, well-maintained plugins; test big updates (WooCommerce, page builders) on a copy of the site before production.
• Delete unused themes and plugins: even deactivated, their files stay on the server and may contain a flaw.

2. Serious passwords and access

• A long, unique password per account, stored in a password manager.
• Two-factor authentication on every administrator account.
• The right role for each person: an editor does not need to be an administrator.
• Removing accounts that are no longer used: former contractor, former employee, test account.

To quickly list administrators with WP-CLI:

wp user list --role=administrator --fields=ID,user_login,user_email

An administrator nobody recognizes is a red flag.

3. Regular, tested backups

Perfect security does not exist: what really protects you is being able to roll back quickly to a clean version. You need backups of the database and files, kept off the server, over several days, and already tested: see the backup rule almost nobody follows.

4. Carefully chosen plugins

Every active plugin is a potential entry point.

• Before installing a plugin, check its last update date and its compatibility with your WordPress version: a plugin abandoned for years is a risk, even if it still works.
• Never install a “free” copy of a premium plugin found on a download site: these pirated copies often contain malicious code.
• Deactivate and delete the ones you no longer use.

5. A firewall and login attempt limits

Blocking repeated login attempts and filtering suspicious traffic before it reaches WordPress greatly reduces the attack surface, without daily manual work. A web application firewall can sit in front of the site (Cloudflare, for example) or be installed as a plugin.

6. A hardened configuration

A few settings to apply once:

• Disable the dashboard file editor in wp-config.php, so a hacked account cannot change the site’s code:

define( 'DISALLOW_FILE_EDIT', true );

• Strict file permissions: usually 755 for folders, 644 for files, and stricter for wp-config.php.
• The whole site on HTTPS.
• Disable XML-RPC if nothing uses it (no mobile app or service relying on it): it is a frequent target for password attacks.

Warning signs

• Redirects to other sites, especially from Google or on mobile.
• A sudden slowdown, or a server sending emails in bulk.
• Modified files nobody touched, or an unknown administrator.
• A Google warning in search results or in Search Console.

In that case, act quickly: change every password, restore a clean backup, update everything, then find how the attack got in and close that door. The later the intervention, the longer and more uncertain the clean-up.

The checklist

1. Core, theme and plugins up to date; unused themes and plugins deleted.
2. Unique passwords, two-factor authentication for administrators, unused accounts removed.
3. Backups off the server, over several days, tested.
4. Maintained plugins, never a pirated copy.
5. Firewall and login attempt limits.
6. File editor disabled, strict file permissions, HTTPS, XML-RPC disabled if unused.

Going further: my expertise: Freelance WordPress developer · read also: 5 reasons your WordPress site is slow (and how to fix it)