Your WordPress security checklist

WordPress runs a lot of small business websites because it's flexible and affordable. The trade-off is that you, or whoever looks after your site, are responsible for keeping all of its moving parts up to date.

Most of the work is routine. Go through this checklist once, then set a monthly reminder to repeat the parts that need repeating. Pick the area you're least sure about and start there.

Why do WordPress sites get hacked?

Most WordPress break-ins aren't personal. Automated tools scan huge numbers of websites looking for known weaknesses, like an outdated plugin or an account with a guessable password, and try them everywhere.

WordPress's own hardening guide says that when sites get hacked, the cause is "rarely" the hosting infrastructure and "most often attributed to the application itself", meaning the WordPress install, plugins, themes and accounts that you're responsible for.

Those are the things this checklist covers. Before you start, write down everyone who can log in to your WordPress dashboard and your hosting account. You'll use that list in the login section.

How do I keep WordPress, plugins and themes updated?

Updates are the single most useful habit. When a security problem is found and fixed, the details often become public, which makes older versions easier to attack.

Check for updates

1. Log in to WordPress and go to Dashboard → Updates.
2. Take a backup first if your host doesn't do this automatically (see the backup section below).
3. Update WordPress itself, then plugins, then themes.
4. Visit your site afterward and click through key pages, forms and checkout.

Turn on automatic updates

WordPress has updated itself automatically for minor and security releases since version 3.7. For plugins and themes, go to Plugins → Installed Plugins and click Enable auto-updates next to each plugin you trust. Themes have the same option under Appearance → Themes.

The FTC's small business guidance gives the same advice for all your software: "Turn on automatic updates."

If you're unsure about the PHP version, ask your host. It's a routine question and most hosts let you change it from their dashboard.

Which plugins and themes should I delete?

Every plugin is extra code that needs updating. WordPress's documentation advises: "if you are not using a specific plugin, delete it from the system." A deactivated plugin still has its files on your server, so deactivating isn't enough.

Here's how to tidy up:

1. Go to Plugins → Installed Plugins and click Inactive.
2. Delete anything you don't plan to use again.
3. For active plugins, check when each was last updated. A plugin that hasn't been updated in a long time may be abandoned. Look for a maintained alternative.
4. Under Appearance → Themes, delete themes you don't use. Many people keep one current default WordPress theme as a fallback.

Only install plugins and themes from the WordPress.org directory or well-known companies. WordPress warns that getting them from elsewhere "may lead to issues." Avoid "nulled" (pirated) premium plugins entirely, since they're a common way malicious code gets onto sites.

How do I lock down WordPress logins?

Logins are where most automated attacks aim.

Use long, unique passwords

The FTC's guidance says "a strong password is at least 12 characters" and to never reuse passwords. A password manager makes this painless. Change any admin password that's ever been reused, shared by email, or used by someone who's left.

Turn on two-step login

Two-step login, also called multi-factor authentication (MFA), asks for a code from your phone or a security key after your password. WordPress's brute force guide notes that core WordPress doesn't include it, so add it with a reputable plugin or your host's login feature. Turn it on for every administrator.

Keep admin accounts to a minimum

Go to Users → All Users and filter by Administrator. Remove former staff, old agencies and freelancers who've finished their work. Give day-to-day users the Editor or Author role instead. WordPress also recommends not using the username admin, since it's the first one bots try.

Limit login attempts

Bots try thousands of password guesses. The FTC recommends limiting unsuccessful login attempts, and WordPress suggests doing this at your host or a web firewall where possible, or with a security plugin. A CAPTCHA on the login page also slows bots down.

Don't forget the accounts around WordPress. Your hosting account and the email address that receives password resets can unlock everything, so give them strong passwords and two-step login too.

Check your WordPress site from the outside

Run a free scan to see your HTTPS setup, certificate, security headers and whether your site reveals its WordPress version.

• Free check
• No signup
• No changes to your website

Get your free report in seconds.

Your website address

Check my website

How should I back up my WordPress site?

Backups are what turn a bad day into a minor inconvenience. A full WordPress backup has two parts: your files (WordPress, themes, plugins and uploads) and your database (posts, pages, settings and users). You need both to restore.

WordPress's backup guide suggests weekly backups for smaller sites and daily backups for busy ones. It also recommends keeping several recent copies in different places, such as your host, cloud storage and your own computer.

Ask your host three questions:

• How often do you back up my site, and how long do you keep each copy?
• Do backups include both files and the database?
• How do I restore one, and how long does it take?

If the answers aren't reassuring, add a reputable backup plugin that saves copies off your server. Then try restoring once, even to a test copy of your site, so you know the backup works. Good backups are also your best defense against ransomware.

Do I need managed hosting or a security plugin?

Your host is the foundation. WordPress's hardening guide says a trusted host "readily discusses your security concerns," provides current server software, and offers "reliable methods for backup and recovery."

Managed WordPress hosting usually goes further. Many managed hosts handle server updates, daily backups, login protection, a web firewall and malware scanning for you. For a business without IT staff, that's often worth the extra cost.

A security plugin fills gaps your host doesn't cover. A good one can:

• Add two-step login and limit login attempts
• Run a web application firewall that blocks common attacks
• Alert you to file changes and scan for malware
• Keep an activity log showing who changed what

Use one security plugin, not several, since overlapping plugins can conflict. No plugin makes up for skipped updates or weak passwords.

How do I set up HTTPS and security headers?

HTTPS encrypts the connection between your visitors and your site, and it powers the padlock in the address bar. It relies on an SSL certificate, which most hosts provide free.

1. In your hosting control panel, find SSL/TLS or Let's Encrypt and issue a certificate for your domain.
2. In WordPress, go to Settings → General and change both addresses to start with https://.
3. Turn on your host's Force HTTPS option so every visitor gets the encrypted version.
4. If the padlock still doesn't appear on some pages, see our guide on why a website says "Not secure".

Security headers are short instructions your site sends to browsers. They tell browsers to always use HTTPS (HSTS), refuse to load your site inside other sites, and limit risky behavior. Visitors never see them, but they make several common attacks harder.

For WordPress, ask your host first, since many managed hosts can add them in their control panel. If not, a reputable headers plugin can enable them. Afterward, click around your site, especially forms, embedded videos and checkout, to make sure nothing broke. Then confirm the results with our free security headers checker.

Should I hide my WordPress version number?

Many WordPress sites announce their version in the page code with a line like meta name="generator" content="WordPress 6.x". Servers sometimes do the same in headers such as Server or X-Powered-By.

The version number alone isn't a vulnerability, but if that version has known problems, it tells automated tools exactly what to try. CyberVigil's free scan flags it for that reason.

WordPress calls hiding information "generally an unsound primary strategy," and that's fair. Being up to date matters far more than hiding the number. So do it in this order:

1. Update WordPress, your theme and all plugins under Dashboard → Updates.
2. Turn on your security plugin's "hide WordPress version" option, or ask your host to remove the generator tag.
3. Ask your host to hide server and PHP version details too. It's a quick configuration change for them.
4. Re-run a free website scan to confirm.

What should you do next?

You don't need to do everything today. Work through it in small pieces and keep a simple monthly routine.

1. Run a free website security scan to see your HTTPS, certificate, headers and version disclosure in one report.
2. Check your certificate on its own with the SSL checker.
3. If something already looks wrong, read how to tell if your website is hacked.
4. For the rest of your business, from email to devices, use our small business cybersecurity checklist.