WordPress Security Checklist for Small Business Websites (20 Steps)

Most hacked WordPress sites aren't targeted personally. Automated bots scan millions of websites looking for known weaknesses like outdated plugins and weak passwords. The good news is that a handful of basic steps block the vast majority of these attacks. Use this checklist to secure your business website.

Updates and software

1. Keep WordPress core updated. Minor security releases often install automatically; apply major updates after a backup.
2. Update plugins and themes promptly. Outdated plugins are the most common way into WordPress sites.
3. Delete unused plugins and themes. Deactivated code can still be exploited if it's vulnerable.
4. Avoid abandoned plugins. If a plugin hasn't been updated in a long time, look for a maintained alternative.
5. Never use "nulled" (pirated) themes or plugins. They frequently contain hidden malware.
6. Run a current PHP version supported by your host.

Logins and users

7. Use strong, unique passwords for every admin, with a password manager.
8. Turn on two-factor authentication (2FA) for all administrator accounts.
9. Limit login attempts to slow down password-guessing bots.
10. Don't use "admin" as a username.
11. Give people the lowest role they need. Editors and authors don't need administrator access.
12. Remove old users such as former staff, agencies and freelancers once their work is done.

Backups

13. Automatic daily backups of files and database.
14. Store backups off-site (cloud storage), not only on the same server.
15. Test restoring a backup occasionally. An untested backup might fail when you need it.

Hosting and server

16. Choose reputable hosting with malware scanning, firewalls and account isolation.
17. Use HTTPS everywhere with a valid SSL certificate.
18. Use SFTP, not FTP, and secure your hosting control panel with 2FA.

Monitoring and protection

19. Install a reputable security plugin or firewall to block malicious traffic and scan for malware.
20. Monitor Google Search Console for security warnings, and set up uptime monitoring so you know quickly if the site goes down.

Signs something is already wrong

Unexpected redirects, strange pages in Google results, unknown admin users or browser warnings are signs of an existing infection. See our guide to the signs of a hacked WordPress site, and get it cleaned properly before hardening.

Make security routine

Security isn't a one-time task. Updates, backups and checks need to happen every month. Many businesses put their site on a maintenance plan so this happens consistently without them having to remember.

Sameer Gupta

Freelance WordPress developer and founder of Samverse. Builds websites for clinics, manufacturers, agencies and online stores.