WordPress Security Checklist

The checks I'd run through on any WordPress site I was securing. Work through them in order, or jump to the section most relevant to the problem you're fixing.

Hosting & Server

• Choose a host that isolates your site from others on the same server
• Run a supported, current version of PHP (8.4 preferred, 8.3 acceptable)
• Disable root SSH login and enforce SSH key authentication
• Disable directory listing on the server

WordPress Core

• Keep WordPress core current, running updates through staging first on a site that earns money
• Change the default wp-login.php login URL
• Disable the built in file editor in the WordPress dashboard
• Disable XML-RPC if you are not actively using it
• Replace WP-Cron with a real server side cron job
• Remove any unused themes, including the default ones
• Remove any unused plugins

Users & Authentication

• Delete or rename the default "admin" user account
• Use a strong, unique password for every user account
• Enable two factor authentication for all admin users, preferring passkeys where the plugin supports them
• Limit login attempts to block brute force attacks
• Block user enumeration via author archives and the REST API
• Review user roles and remove accounts that no longer need access
• Audit Application Passwords and disable them entirely if nothing is using them

File & Database Security

• Set correct file permissions (755 for directories, 644 for files, 440 for wp-config.php)
• Change the default WordPress database table prefix from "wp_"
• Restrict the database user to only the privileges WordPress actually needs
• Restrict access to wp-config.php

SSL & HTTPS

• Install a valid SSL certificate
• Force all traffic over HTTPS, including redirects from HTTP
• Set the HSTS header to prevent protocol downgrade attacks

Firewall & Plugins

• Install and configure a WordPress firewall plugin
• Set up a cloud based WAF such as Cloudflare in front of your site
• Run regular malware scans on the site
• Keep plugins and themes current, with auto updates on for low-footprint plugins
• Update wide-reach plugins (commerce, page builders, security, backups) manually, after a 24 to 48 hour observation window
• Keep an inventory of what's installed and who maintains it, and treat a sudden release from a long-stable plugin with suspicion

Backups & Monitoring

• Set up automated daily backups
• Store backups off site, not just on your server
• Test your backup restore process at least once
• Set up uptime monitoring so you know immediately if the site goes down
• Verify Google Search Console is set up and notifications are enabled
• Enable activity logging to track changes and login attempts

AI Agents & Automation

• Know which agents, plugins or integrations can act on your site, and remove the ones you don't use
• Scope every automation to its own account with the narrowest role that works, never an admin account
• Rotate or revoke Application Passwords when an integration is retired
• Log what automated accounts do, and alert on content or user changes you didn't trigger
• Treat anything an agent reads from your site as untrusted input, not as instructions