Skip to content 
Use this WordPress security checklist to review the most important security controls on your website.
WordPress security is not about installing one plugin or changing one setting. A properly secured website uses multiple layers, including updated software, strong authentication, appropriate permissions, backups, malware detection, firewall protection, secure hosting, and ongoing monitoring.
Use the checklist below for a practical security review.
For detailed explanations and implementation guidance, see the WordPress Security Guide.
1. Keep WordPress Core Updated
☐ Confirm that WordPress is running a supported version.
☐ Install security and maintenance updates promptly.
☐ Test major updates on staging when your website has custom code or critical functionality.
☐ Keep a recent backup before significant updates.
WordPress recommends keeping WordPress itself and installed plugins and themes up to date because outdated software can contain known vulnerabilities.
2. Keep Plugins and Themes Updated
☐ Update plugins regularly.
☐ Update themes regularly.
☐ Remove plugins that are no longer required.
☐ Remove themes that are no longer needed, while keeping an appropriate fallback theme when useful.
☐ Avoid nulled, pirated, or modified plugins and themes from untrusted sources.
☐ Review whether important plugins are actively maintained.
Every additional plugin or theme adds software that needs to be maintained. Use only the components your website actually needs.
3. Use Secure Hosting
☐ Use a reputable hosting provider.
☐ Keep the server operating system and control-panel software updated.
☐ Use a supported PHP version.
☐ Use SFTP or SSH instead of unencrypted FTP when available.
☐ Restrict server access to the people and systems that need it.
☐ Use separate hosting/server credentials instead of sharing accounts.
The current PHP support lifecycle should be checked before selecting a version. As of 2026, PHP 8.2, 8.3, 8.4, and 8.5 remain supported, with different support end dates.
4. Review Administrator Accounts
☐ Remove administrator accounts that are no longer required.
☐ Remove accounts belonging to former employees or contractors.
☐ Avoid shared administrator accounts.
☐ Give users only the permissions they need.
☐ Review administrator accounts periodically.
The fewer people with full administrative access, the smaller the potential impact of a compromised account.
5. Use Strong, Unique Passwords
☐ Use a long, unique password or passphrase for every important account.
☐ Use a reputable password manager.
☐ Never reuse your WordPress administrator password on another website.
☐ Do not use passwords based on your name, company, domain, username, or other easily guessed information.
☐ Change credentials if you believe an account has been compromised.
A strong password is one layer of protection. It should be combined with additional controls such as MFA, least-privilege access, and login protection. WordPress also recommends strong passwords and additional authentication measures.
6. Enable Two-Factor Authentication
☐ Enable 2FA/MFA for administrator accounts.
☐ Enable MFA for hosting, domain, cloud, and other important accounts where supported.
☐ Prefer an authenticator application or security key where appropriate.
☐ Store recovery codes securely.
Two-factor authentication significantly reduces the risk of account takeover when a password is stolen, but it does not eliminate every possible authentication attack.
7. Apply the Principle of Least Privilege
☐ Give each WordPress user the lowest role required for their work.
☐ Avoid giving Administrator access when Editor or another role is sufficient.
☐ Review user roles periodically.
☐ Remove unnecessary accounts.
☐ Review application, hosting, database, and SFTP/SSH permissions as well.
Security is not only about WordPress roles. The same principle should be applied throughout the hosting and infrastructure environment.
8. Protect the Login System
☐ Use login rate limiting or brute-force protection.
☐ Monitor repeated failed login attempts.
☐ Consider bot protection or CAPTCHA where appropriate.
☐ Use MFA for privileged users.
☐ Consider WAF rules for sensitive login endpoints.
Changing or hiding the login URL can reduce some automated traffic, but it should not be treated as the primary security control.
Strong authentication and rate limiting are more important.
9. Review XML-RPC
☐ Determine whether your website actually needs XML-RPC.
☐ If it is not required, consider disabling or restricting it.
☐ If a legitimate integration depends on XML-RPC, secure it rather than disabling it blindly.
☐ Review authentication-related XML-RPC activity if it is enabled.
XML-RPC is a legitimate WordPress interface used by some integrations. However, certain methods can increase the attack surface and may be abused for authentication attacks.
Do not disable XML-RPC without first checking whether your website or an integration depends on it.
10. Review File Permissions and Ownership
☐ Check that files are not unnecessarily writable.
☐ Avoid 777 permissions.
☐ Review file ownership.
☐ Check which directories WordPress needs to write to.
☐ Verify permissions according to your hosting and PHP execution model.
Common WordPress installations often use permissions such as 644 for files and 755 for directories, but these are not universal requirements. WordPress’ own documentation notes that permissions depend on the installation and server environment.
Do not run blanket permission-changing commands without understanding your server’s ownership and execution model.
11. Protect wp-config.php
☐ Prevent unauthorized access to wp-config.php.
☐ Keep database credentials private.
☐ Use appropriate file permissions.
☐ Protect the file from direct HTTP access where appropriate.
☐ Rotate database credentials and authentication secrets after a confirmed compromise.
For Apache 2.4, an example access-control rule is:
<Files "wp-config.php">
Require all denied
</Files>
The exact implementation depends on your server configuration. Do not use an Apache rule on an Nginx server.
WordPress also documents protecting wp-config.php as part of its hardening guidance.
12. Disable the WordPress File Editor
☐ Consider disabling the built-in plugin and theme file editor on production websites.
Add this to wp-config.php:
define( 'DISALLOW_FILE_EDIT', true );
This removes the ability to edit plugin and theme PHP files from the WordPress dashboard.
It does not prevent someone with server-level access from modifying files, so it should be treated as an additional hardening measure rather than a complete security solution. WordPress documents this setting as a hardening option.
13. Use a Web Application Firewall
☐ Consider using a CDN or WAF appropriate for your website.
☐ Configure rate limiting for sensitive endpoints where appropriate.
☐ Review firewall events and blocked requests.
☐ Protect high-risk areas such as login and administrative endpoints.
☐ Test firewall rules before deploying aggressive blocking rules.
A WAF can provide an additional layer between malicious traffic and your WordPress application.
However, a WAF does not replace software updates, strong authentication, secure hosting, backups, or vulnerability management.
14. Maintain Reliable Backups
☐ Back up the WordPress database.
☐ Back up website files.
☐ Store at least one copy separately from the production server.
☐ Use an appropriate backup retention policy.
☐ Protect backup access with strong authentication.
☐ Test restoration regularly.
A backup should not be considered reliable simply because the backup job reports that it completed.
Test that you can actually restore the website and database.
For important websites, document the recovery process so another administrator can follow it during an emergency.
15. Monitor for Malware and Unexpected Changes
☐ Run malware scans appropriate to your website’s risk level.
☐ Monitor unexpected file changes.
☐ Check for suspicious PHP files.
☐ Review unexpected redirects.
☐ Look for unfamiliar administrator accounts.
☐ Investigate unexpected spam pages or search-engine warnings.
☐ Review security and server logs when suspicious activity occurs.
A malware scanner is useful, but a clean scan does not guarantee that a sophisticated compromise does not exist.
For high-value websites, combine automated scanning with monitoring and manual investigation when necessary.
16. Keep HTTPS Properly Configured
☐ Use a valid TLS certificate.
☐ Make sure the WordPress website loads correctly over HTTPS.
☐ Redirect HTTP traffic to HTTPS where appropriate.
☐ Check for mixed-content problems.
☐ Test login forms and other sensitive functionality.
☐ Test WooCommerce checkout and payment integrations if applicable.
HTTPS protects data transmitted between the visitor and the website, but it does not secure a compromised WordPress installation by itself.
17. Review Security Headers
☐ Check whether your website uses appropriate security headers.
Depending on your environment, these may include:
Strict-Transport-SecurityContent-Security-PolicyX-Content-Type-OptionsReferrer-PolicyPermissions-Policy- Clickjacking protection using
frame-ancestorsorX-Frame-Options
Do not copy a generic Content Security Policy and deploy it without testing.
Your CSP needs to account for the scripts, fonts, analytics, advertising, payment providers, embeds, APIs, and other third-party resources actually used by your website.
Also remember that header configuration depends on your web server, CDN, or hosting platform. It does not always belong in .htaccess.
18. Prevent Unnecessary PHP Execution
☐ Review whether PHP execution is required in directories intended only for uploaded files.
☐ Pay particular attention to wp-content/uploads/.
☐ Where appropriate, configure the server to prevent uploaded PHP files from executing.
☐ Test the configuration after making changes.
This can reduce the impact of certain file-upload compromises.
The correct configuration depends on whether your server uses Apache, Nginx, PHP-FPM, or another environment.
Never apply a server rule without confirming that it matches your actual hosting configuration.
19. Monitor Vulnerabilities and Security Advisories
☐ Maintain an inventory of installed plugins and themes.
☐ Monitor security advisories affecting your software.
☐ Prioritize serious vulnerabilities.
☐ Apply security fixes promptly.
☐ Remove or replace abandoned software when appropriate.
☐ Investigate plugins or themes that have known vulnerabilities without an available fix.
Keeping software updated is one of the most important WordPress security controls. WordPress specifically recommends keeping WordPress, plugins, and themes up to date and choosing actively maintained software.
20. Prepare and Test Your Recovery Plan
☐ Know how to restore your website from a clean backup.
☐ Keep hosting and domain-provider contact information available.
☐ Know where important credentials are stored securely.
☐ Know how to rotate WordPress, hosting, database, and SFTP/SSH credentials.
☐ Document the steps to take if the website is hacked.
☐ Test your restoration process.
If a compromise occurs, do not simply delete suspicious files without investigation.
A proper response may involve:
- Containing the compromise
- Preserving relevant evidence
- Identifying the entry point
- Removing malware and backdoors
- Updating vulnerable software
- Rotating credentials
- Restoring from a verified clean backup when appropriate
- Monitoring for reinfection
Final WordPress Security Review
Completing this checklist can help identify many common WordPress security weaknesses, but no checklist can guarantee that a website will never be compromised.
Security should be treated as an ongoing process.
Continue to:
- Keep software updated
- Review administrator accounts
- Monitor vulnerabilities
- Maintain tested backups
- Monitor suspicious activity
- Review server and security logs
- Protect important accounts with MFA
- Review firewall and WAF events
- Test your recovery process
If you need help identifying vulnerabilities, hardening a WordPress website, removing malware, or reviewing your security configuration, a professional WordPress security audit can provide a more detailed assessment.
Need a WordPress Security Audit?
A checklist can help you identify common issues, but a professional audit can go further by reviewing your WordPress configuration, plugins, themes, user accounts, server environment, security headers, firewall configuration, suspicious files, and other technical security controls.
