WordPress Security Checklist: 12 Steps I Use on Every Client Site
I’ve cleaned up hacked WordPress sites, and it’s never fun — for the owner or for me. The good news: most hacks are preventable with basics done right. Here’s the exact security checklist I run through for every client site I manage.
1. Keep everything updated
Core, themes, plugins — outdated software is the #1 way sites get hacked. I enable auto-updates for minor releases and check major ones promptly. If a plugin hasn’t been updated by its author in over a year, I replace it.
2. Use strong, unique passwords
“admin” as a username with a weak password is an open invitation. I use a password manager and enforce strong passwords for every account, including hosting and FTP.
3. Limit login attempts
Brute-force bots hammer wp-login.php around the clock. A login limiter plugin stops them cold after a few failed tries. This single step blocks the vast majority of automated attacks.
4. Enable two-factor authentication
Even if a password leaks, 2FA stops the attacker. I set this up on every admin account — it takes two minutes and is the highest-value security step you can take.
5. Install an SSL certificate
HTTPS is non-negotiable in 2026 — for security and for Google rankings. Most good hosts include free SSL. If your site still loads over HTTP, fix that today.
6. Back up automatically
Security isn’t just prevention — it’s recovery. I keep automated off-site backups for every site I manage, so even in the worst case we can restore in minutes.
7. Remove unused themes and plugins
Every inactive plugin is a potential vulnerability sitting on your server. I delete anything not in active use — deactivating isn’t enough.
8. Change the default login URL
Moving wp-login.php to a custom URL cuts automated attack traffic dramatically. Bots can’t attack what they can’t find.
9. Set correct file permissions
Folders should be 755, files 644, and wp-config.php 600 or 640. Loose permissions are a quiet risk I check on every site I touch.
10. Use a security plugin
A good firewall plugin adds malware scanning, file-change detection and IP blocking. I configure one on every managed site.
11. Disable file editing in the dashboard
Adding define('DISALLOW_FILE_EDIT', true); to wp-config.php stops attackers (and accidents) from editing theme and plugin files through the admin.
12. Monitor and maintain
Security is ongoing, not one-time. My monthly maintenance covers updates, scans, backups and uptime monitoring — so you never have to think about any of this.
Already hacked?
Don’t panic — and don’t wait. I’ve cleaned and re-secured hacked sites many times. Contact me and I’ll assess the damage and get you clean fast.
