Most WordPress security advice arrives as a pile of tips with no order to them. Change this setting, install that plugin, tick this box. What's missing is the shape of the thing: what actually matters, what's just noise, and what order to do it in.
This is the checklist I work through on any WordPress site I'm securing. It's grouped the way I think about it, from the ground up, because the layers build on each other. There's no point hardening logins on a site sitting on a neglected server, and no point obsessing over file permissions if your admin password leaked two years ago.
Work through it in order, or jump to the section most relevant to the problem you're fixing. Each item is a real reduction in risk, not a box ticked for the sake of it.
Hosting & Server
This is the floor everything else stands on. Get it wrong and nothing above it holds.
Good hosting does real work here, but only at this layer. Everything below this point is yours, and it's where most compromises actually happen.
WordPress Core
A default WordPress install ships with a handful of choices that suit a first-time user, not a site you care about.
The file editor one matters more than it looks. It hands direct code execution to anyone who gets into the dashboard. Turning it off costs you nothing and closes a door.
Users & Authentication
A correct login with valid credentials looks exactly like you. No firewall can tell the difference, so this layer is entirely down to how you manage accounts.
Two factor authentication is the single highest-value item on this whole list. A breached or reused password becomes almost harmless once a second factor stands behind it.
File & Database Security
The layer beneath the dashboard. Locked down properly, it limits how far an attacker can get even after a foothold.
That last file holds your database credentials and security keys. It deserves the tightest permissions on the whole site.
SSL & HTTPS
Non-negotiable now, and quick to get right.
A certificate alone isn't enough if HTTP still answers. The redirect and the HSTS header are what actually close the gap.
Firewall & Plugins
Plugins are the single most common entry point for WordPress compromises. This is where most of the ongoing work lives.
An outdated plugin with a known, published vulnerability is the most common way sites get hit. Updates are the cheapest security work you'll ever do, which is exactly why the observation window matters: it keeps you current without making you the first site to run a bad release.
Backups & Monitoring
The layer that decides how bad a bad day gets. Everything above reduces the chance of a compromise. This is what you're glad of when one happens anyway.
A backup you have never restored is a guess, not a safety net. Test it once, now, while nothing is on fire.
AI Agents & Automation
WordPress 7 put an AI agent behind your login, and every integration you connect is another account that can act on the site. Treat them like staff, with a role, a log and an exit.