This WordPress security hardening checklist covers the measures that block the most common attacks: weak or reused passwords, outdated plugins, unnecessary admin accounts and missing backups. Tick each item as you complete it. Ticks are saved only in your browser, and Print checklist gives you a paper copy.
This checklist does not scan or secure your site automatically. It lists actions for you or your developer to take. No checklist makes a site impossible to hack, but these steps remove the easiest ways in and make recovery much faster.
0 of 25 done
Print checklist Reset
Accounts and access Use a unique, strong password for every administrator A password manager makes long, unique passwords practical. Never reuse a WordPress password elsewhere. Turn on multifactor authentication for administrators Use an authenticator app or security key where your setup supports it. See stopping brute-force attacks and our security plugin comparison . Give each person the lowest role they need Editors and authors rarely need Administrator. Review Users → All Users and lower roles where possible. Remove accounts that are no longer used Former staff, agencies and test accounts. Reassign their content before deleting them. Investigate any administrator you do not recognise Do not just delete it. See unknown admin user keeps coming back . Secure hosting, SFTP, database and domain logins too Attackers often get in through the hosting account or email, not WordPress itself. Software and code Keep WordPress, plugins and themes updated Decide which items update automatically. See our auto-updates policy . Delete plugins and themes you do not use Deactivated code still sits on the server. Keep one default theme as a fallback. Install plugins and themes only from trusted sources Use WordPress.org or the developer’s own site. Never use “nulled” copies of premium plugins. Replace abandoned plugins A plugin with no updates for a long time may never receive security fixes. Run a supported PHP version Check Tools → Site Health → Info → Server, and test upgrades on staging. Configuration Serve the whole site over HTTPS Check the certificate and fix mixed content. See mixed content warnings . Disable the built-in file editor Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php so a stolen admin login cannot edit PHP files from the dashboard. See wp-config.php security settings . Decide whether you need XML-RPC If no app uses it, disabling it removes an attack surface. See should you disable XML-RPC . Check file permissions with your host The WordPress documentation commonly suggests 755 for folders and 644 for files; your host may recommend stricter settings. Turn off debug display on the live site WP_DEBUG_DISPLAY should be false so errors and file paths are not shown to visitors. Backups and monitoring Keep verified, off-site backups Check archive contents and test a restore on staging. See how to prove a backup will restore . Watch for new administrator accounts Check the user list regularly or use a security plugin that alerts you. Watch for unexpected file changes New files in wp-content/mu-plugins, uploads or the root folder deserve attention. Add your site to Google Search Console Its Security issues report tells you if Google detects malware or hacked content. See signs of a hacked site . Use an uptime monitor Find out about errors and downtime before your visitors tell you. If something goes wrong Back up the current state before cleaning Even an infected site should be backed up as evidence and as a fallback. Change all passwords and the security salts WordPress users, hosting, SFTP, database and email accounts. Find the way in, not just the symptom See site redirecting to spam for a full investigation order. Know when to call for help Payments, personal data or repeated reinfection are reasons to contact your host or a security professional. Where to start if you only have 30 minutes
Change any reused or weak administrator passwords and turn on multifactor authentication.
Update everything and delete unused plugins and themes.
Confirm you have a recent backup stored away from the server.
For more background, read the official WordPress hardening guide . For ongoing upkeep, use the WordPress maintenance checklist .
