WordPress powers over 40% of the web, making it the most targeted CMS by attackers. The good news is that most WordPress breaches exploit known, preventable vulnerabilities. Follow this checklist to secure your site against the most common attacks.
Authentication and Access
1. Use strong, unique passwords: Every admin account should use a password of at least 16 characters generated by a password manager. Never reuse passwords across sites.
2. Enable two-factor authentication: Install a 2FA plugin and enforce it for all administrator and editor accounts. TOTP-based apps (Google Authenticator, Authy) are preferable to SMS.
3. Limit login attempts: Use a plugin to block IP addresses after 5 failed login attempts. This stops brute-force attacks cold.
4. Change the default admin username: If your admin account is still named “admin,” create a new administrator account with a unique username, transfer ownership, and delete the old one.
Updates and Maintenance
5. Keep WordPress core updated: Enable automatic minor updates (security patches). Apply major updates within one week of release after testing on staging.
6. Update all plugins and themes: Outdated plugins are the number one attack vector for WordPress sites. Update weekly. Remove any plugins and themes you are not actively using — deactivated plugins can still be exploited.
7. Use plugins from trusted sources: Only install plugins from the official WordPress repository or reputable commercial developers. Check the last update date, active installations, and support forum activity before installing.
Backups
8. Automate daily backups: Use a backup plugin to create daily backups of your database and weekly full-site backups. Store backups off-site — not on the same server as your website.
9. Test your backups: A backup you have never restored is not a backup. Test a full restore on a staging environment at least quarterly to verify your backups actually work.
Hosting and Infrastructure
10. Use HTTPS everywhere: Install an SSL certificate and force HTTPS for all pages. This protects data in transit and is a Google ranking factor. Most hosts offer free Let’s Encrypt certificates.
11. Choose a secure host: Your hosting provider should offer server-level firewalls, malware scanning, automatic patching, and PHP version management. Managed WordPress hosts handle much of this for you.
12. Use the latest PHP version: Older PHP versions (7.x and below) no longer receive security patches. Upgrade to PHP 8.2 or later for both security and performance benefits.
Monitoring and Hardening
13. Install a security plugin: Use Wordfence or Patchstack to add a web application firewall (WAF), malware scanning, and real-time threat intelligence. Configure alerts for file changes, failed logins, and plugin vulnerabilities.
14. Disable file editing: Add define('DISALLOW_FILE_EDIT', true); to wp-config.php to prevent editing theme and plugin files from the WordPress dashboard. If an attacker gains admin access, this stops them from injecting code through the built-in editor.
15. Monitor uptime and file integrity: Set up uptime monitoring to detect defacements or outages immediately. Use your security plugin’s file integrity monitoring to detect unauthorised changes to core files, plugins, or themes.
Bonus: Security Headers
Configure HTTP security headers through your host or a plugin: Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Strict-Transport-Security (HSTS), and Referrer-Policy. These headers add defence-in-depth against XSS, clickjacking, and MIME-type attacks at the browser level.
