WordPress Security Checklist: 25 Steps to Harden a Business Website

On this page

1. Which steps to do first
2. Logins and users
3. Updates and software
4. wp-config.php and files
5. Reduce what attackers can reach
6. Firewall and monitoring
7. Backups and hosting
8. How to tell if hardening came too late
9. A monthly security routine
10. Quick check
11. When to get help
12. FAQs

To secure a WordPress site, keep core, plugins and themes updated, protect every admin login with a strong password and two-factor authentication, remove users and plugins you don't need, turn off file editing in the dashboard, run one reputable security plugin, and keep daily off-site backups you've tested. Those basics stop most attacks, because most hacked sites are found by automated bots scanning for known weaknesses, not targeted by a person.

This is the general hardening checklist I use for business sites, split into what to do today and what to do this month. Running it every month is the core of my WordPress maintenance plans. If your site already shows signs of a hack, clean it first, because hardening an infected site leaves the backdoors in place; see hacked site repair.

Which steps to do first

Priority	Steps	Why
Do today	1, 2, 6, 7, 8, 23	Closes the most common ways in and makes recovery possible
Do this week	3, 5, 11, 16, 19, 22	Blocks password guessing and limits the damage a stolen login can do
Do this month	The rest	Server-level hardening, monitoring and hosting

Running an online store? Payments, customer data and fraud orders need extra steps on top of these; see the WooCommerce security checklist.

See also: a WordPress activity log.

Related: stopping spam user registrations in WordPress.

Logins and users

• 1. Use strong, unique passwords for every admin, stored in a password manager. Reused passwords leaked from other sites are a common way in.
• 2. Turn on two-factor authentication (2FA) for administrators and editors, using an authenticator app. Wordfence's login security module and Solid Security both include it in their free versions at the time of writing. Save the backup codes somewhere safe so a lost phone doesn't lock you out.
• 3. Limit login attempts so bots can't guess passwords endlessly. Most security plugins do this, and a cloud firewall can block them before they reach your server.
• 4. Don't use "admin" as a username, and make sure your public author name isn't your login name.
• 5. Give people the lowest role they need. Content writers need Editor or Author access, not Administrator.
• 6. Remove old users: former staff, agencies and freelancers. Check the full list of administrators regularly.

More detail on locking down the login page is in how to secure your WordPress login.

Updates and software

• 7. Keep WordPress core, plugins and themes updated, with a backup first. Outdated plugins are one of the most common ways into WordPress sites; follow this safe update process if you're worried about breaking things.
• 8. Delete plugins and themes you don't use. Deactivated code can still be exploited. Keep one default theme as a fallback.
• 9. Avoid abandoned and nulled software. Replace plugins that haven't been updated in a long time, and never install pirated premium themes or plugins, which often carry hidden malware.
• 10. Run a supported PHP version that your plugins are tested with. Old PHP versions stop getting security fixes.

wp-config.php and files

• 11. Turn off the dashboard file editor. If someone gets into an admin account, the theme and plugin editors let them add malicious code in seconds.
• 12. Set sensible file permissions: usually 644 for files and 755 for folders, with wp-config.php tighter where your host allows it. Never use 777.
• 13. Block PHP from running in the uploads folder, where only images and documents should live.
• 14. Never show PHP errors to visitors on a live site, because error messages reveal file paths.
• 15. Refresh the security keys and salts in wp-config.php after a hack or when someone with access leaves. This logs everyone out.

Steps 11 and 14 are two lines in wp-config.php, added above the line that says "That's all, stop editing":

define( 'DISALLOW_FILE_EDIT', true );
define( 'WP_DEBUG', false );

On Apache or LiteSpeed hosting, step 13 is a small .htaccess file placed inside wp-content/uploads. Solid Security and some hosts offer the same as a setting, and Nginx servers need it added to the server configuration instead:

<Files *.php>
  Require all denied
</Files>

More wp-config.php settings, including forcing SSL for the admin area, are covered in hardening wp-config.php.

Reduce what attackers can reach

• 16. Disable XML-RPC if nothing needs it. xmlrpc.php is an old remote-access feature that bots use for password guessing. Jetpack and some apps still rely on it, so check before blocking it; see WordPress XML-RPC explained.
• 17. Consider moving the login page. Changing wp-login.php to a custom address, an option in Solid Security, cuts bot noise but isn't real protection on its own. 2FA matters far more.
• 18. Protect forms and registrations. Untick "Anyone can register" in Settings > General unless you need it, and add Cloudflare Turnstile or reCAPTCHA to forms.

If your host uses Apache or LiteSpeed and nothing uses XML-RPC, this .htaccess rule in the site's root folder blocks it:

<Files xmlrpc.php>
  Require all denied
</Files>

Firewall and monitoring

• 19. Run one security plugin with a firewall and malware scanner, such as Wordfence or Solid Security. Two security plugins together often conflict and slow the site. In Wordfence's free version, new firewall rules and malware signatures arrive later than in the paid version at the time of writing.
• 20. Consider a cloud firewall such as Cloudflare, which filters bad traffic before it reaches your hosting, so less of it ever touches WordPress.
• 21. Keep an activity log of logins, new users, plugin installs and settings changes, so you can see what happened if something goes wrong.
• 22. Monitor uptime and Search Console. An uptime monitor tells you when the site goes down, and Search Console emails you about security issues Google finds.

Which plugin? Wordfence runs its firewall inside WordPress and has a detailed malware scanner, which makes it a sensible default on most hosts, though full scans can be heavy on cheap shared hosting. Solid Security leans more towards hardening and login protection, with settings for 2FA, a custom login address, file change detection and blocking PHP in uploads. Either is fine. Pick one, go through its settings rather than leaving the defaults, and read its alert emails. If your host already runs server-level scanning and a firewall, as many cPanel hosts do with tools such as Imunify360, a lighter plugin focused on logins can be enough.

Developers with SSH access can check whether core and plugin files have been modified, and who has admin access, with WP-CLI:

wp core verify-checksums
wp plugin verify-checksums --all
wp user list --role=administrator --fields=ID,user_login,user_email

Backups and hosting

• 23. Keep daily off-site backups of files and database, stored away from your hosting, and test a restore occasionally. An untested backup can fail exactly when you need it.
• 24. Choose hosting that takes security seriously: account isolation, server-level malware scanning, SFTP or SSH instead of plain FTP, and 2FA on the hosting control panel. Ask whether the host keeps its own backups and how a restore works.
• 25. Use HTTPS everywhere with a valid SSL certificate, and add basic security headers; see security headers explained.

How to tell if hardening came too late

Redirects to spam sites, unfamiliar pages in Google results, new admin users you didn't create, or browser and Google warnings mean the site is probably already compromised. Go through the signs of a hacked WordPress site, then clean it properly using the step-by-step malware removal guide or get help, and only then apply this checklist.

A monthly security routine

1. Apply updates after a backup, and test key pages and forms
2. Review the administrator list and remove anyone who no longer needs access
3. Check the security plugin's scan results and blocked attacks
4. Confirm backups ran and are stored off-site
5. Look at Search Console for security issues and unexpected pages
6. Remove plugins and themes that are no longer needed

Keep your plugin list lean and well maintained; see essential WordPress plugins (and ones to avoid).

More on getting backups right: WordPress backup and restore.

Not sure which role to give whom? See WordPress user roles explained.

Server-side hardening: file permissions and wp-config.php settings.

Quick check

In Users > All Users, filter by Administrator and remove or downgrade any account you don't recognise or no longer need. Then open Tools > Site Health and fix anything listed under security, such as outdated plugins or a PHP version that no longer gets updates. With WP-CLI you can list admins in one line:

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

When to get help

If you find admin accounts you didn't create, files you don't recognise or redirects you can't explain, stop hardening and get the site cleaned first; see WordPress malware removal. For updates with a backup first, security scans and monitoring every month, see WordPress maintenance. Send the details through the contact form for a fixed quote.

FAQs

Is WordPress secure enough for a business website?

Yes, when it's maintained. WordPress core is actively maintained and security fixes are released regularly. Most hacks come from outdated plugins, weak passwords, nulled software and poor hosting, all of which this checklist addresses.

Do I need a security plugin like Wordfence?

For most business sites, yes. A plugin such as Wordfence or Solid Security adds a firewall, malware scanning, login protection and 2FA in one place. Use one, not several, and don't treat it as a substitute for updates and backups.

Should I disable XML-RPC in WordPress?

If nothing on your site uses it, yes. Most sites don't need it, and bots use it for password guessing. Check first whether you use Jetpack, the WordPress mobile app or a service that publishes remotely, because those may need it.

Does changing the WordPress login URL make it more secure?

Only a little. It reduces automated login attempts and log noise, but anyone determined can still find a login page. Strong passwords, 2FA and limited login attempts do the real work.

How often should I check WordPress security?

Check updates weekly or fortnightly and run through a routine like the one above monthly. Review users whenever someone leaves or a project with an outside developer ends.

What should I do if my WordPress site is already hacked?

Don't just restore an old backup or delete the obvious files. Find and remove the malware and any backdoors, change every password, update everything, and then harden the site. A hack that isn't fully cleaned usually comes back.