If you run a WordPress site, security can feel like a topic with no edges: a hundred articles, a thousand opinions, and no clear order to do things in. The good news is that the basics are finite, and most of them are simple. This WordPress security checklist walks you through everything that actually matters, in plain language, grouped into seven sections you can work through one at a time.
You don't need to be technical, and you don't need to do it all today. Start at the top, tick off what you can, and come back for the rest. The vast majority of WordPress sites get compromised through known problems with known fixes, so working a checklist like this one closes the doors that attackers actually use.
How to use this checklist
The sections are ordered roughly by impact, from the changes that matter most to the nice-to-haves:
Keep everything updated
Audit your plugins and themes
Lock down users and logins
Get SSL and certificates right
Harden your configuration
Set up reliable backups
Monitor continuously
If you only do one thing before reading further, do this: run a scan of your site so you know which of these items already need attention. It takes about two minutes and shows you what an attacker sees from the outside.
1. Keep everything updated
Outdated software is the single most common reason WordPress sites get hacked. When a flaw is found in a plugin, theme, or WordPress itself, it's published as a public vulnerability, and attackers scan the web for sites still running the old, unpatched version. Updating is the closest thing to a security cheat code there is.
Update WordPress core to the latest version. Enable automatic updates for minor releases if they aren't on already.
Update all plugins. Check Dashboard → Updates and clear the list.
Update your active theme (and update or delete inactive ones).
Update PHP to a supported version via your hosting control panel. Old PHP versions stop receiving security fixes.
Make updating a routine, not a once-a-year cleanup. New flaws are disclosed daily.
2. Audit your plugins and themes
Plugins and themes are where most WordPress risk lives, simply because there are so many of them and anyone can publish one. You don't need to fear them; most are fine, but you do need to keep the list tidy and trustworthy.
Delete what you don't use. Every deactivated plugin is still code on your server. If you're not using it, remove it.
Check for abandoned plugins. A plugin that hasn't been updated in over a year, or has been removed from the official directory, is a liability. Replace it with a maintained alternative.
Install only from trusted sources, the official WordPress.org directory, or reputable commercial developers. Avoid "nulled" (pirated) premium plugins entirely; they're a well-known malware delivery route.
Limit the total number of plugins. Fewer plugins mean a smaller attack surface and fewer things to keep patched.
Cross-check active plugins against a public vulnerability database to see if any have a disclosed flaw.
3. Lock down users and logins
The login page is the front door, and brute-force attempts against it are constant and automated. Tightening up accounts and authentication shuts down a whole category of attacks.
Remove the default "admin" username. Predictable usernames hand attackers half the puzzle.
Enforce strong, unique passwords for every account, especially administrators. A password manager makes this painless.
Turn on two-factor authentication (2FA) for all admin and editor accounts. This alone defeats the great majority of password-guessing attacks.
Review your user list. Under Users → All Users, remove anyone who no longer needs access, and confirm there are no accounts you don't recognize.
Use the least privilege that works. Don't give someone administrator when editor or author would do.
Limit login attempts so automated guessing gets locked out quickly.
An unfamiliar administrator account is one of the clearest signs of a compromise, so this section doubles as a quick health check.
4. Get SSL and certificates right
An SSL/TLS certificate encrypts traffic between your visitors and your site, and it's table stakes for trust; browsers visibly warn people away from sites without one. Certificates are easy to set up and easy to forget about, which is precisely why they cause problems.
Install a valid SSL certificate. Most hosts offer free Let's Encrypt certificates in a couple of clicks.
Force HTTPS sitewide so no page loads over plain, unencrypted HTTP.
Watch the expiry date. An expired certificate throws a scary browser warning and can effectively take your site offline. Auto-renewal helps, but it can silently fail.
Fix mixed-content warnings, images, or scripts still loading over HTTP on an otherwise secure page.
5. Harden your configuration
Hardening just means switching off features you don't need and closing doors you're not using. None of these are difficult, and together they meaningfully shrink what an attacker has to work with.
Disable the built-in file editor. The dashboard's plugin/theme code editor is a gift to anyone who gets in.
Protect wp-config.php and other sensitive files from public access.
Disable XML-RPC if you don't use it, it's a frequent target for brute-force and amplification attacks.
Turn off directory browsing so visitors can't list the contents of your folders.
Set correct file permissions (typically 644 for files, 755 for directories).
Consider a security plugin or firewall. A firewall blocks malicious traffic before it reaches WordPress, a different and complementary job to scanning.
A quick note on tools, because it's a common point of confusion: a firewall and malware scanner (like Wordfence or Sucuri) run inside WordPress to block and clean threats. A vulnerability scanner checks, from the outside, for known weaknesses you still need to fix. They're not competitors; the strongest setup uses both.
6. Set up reliable backups
Backups don't prevent an attack, but they're what turn a disaster into an inconvenience. If the worst happens, a recent clean backup is often the fastest route back to a working site.
Automate regular backups, at minimum weekly, and more often for active sites.
Back up files and the database, not just one or the other.
Store copies off-site, separate from your hosting. A backup that lives only on a compromised server isn't much help.
Test a restore at least once. An untested backup is a hope, not a plan.
Keep several versions, so you can roll back to a point before a problem started.
7. Monitor continuously
Here's the catch with any checklist: it's a snapshot. You can secure your site perfectly today, and tomorrow a brand-new vulnerability gets disclosed in a plugin you've been running happily for years, without you touching a thing. Security isn't a one-time project; it's an ongoing state.
Scan for vulnerabilities continuously, not just once, so new exposures reach you before they reach an attacker.
Monitor your SSL certificate and DNS for expiry and unexpected changes.
Watch for the warning signs of a compromise: unexpected redirects, unfamiliar accounts, traffic drops, browser warnings.
Check Google Search Console for security notices.
Keep an eye on new CVEs affecting the plugins and themes you actually run.
This is precisely the gap Catcher24 is built to fill. It scans your WordPress site from the outside in, the same view an attacker has, for known vulnerabilities (CVEs), plus certificate and DNS issues, and it keeps watching as new threats appear. Nothing is installed on your server, and there's no plugin to slow your site down. It won't replace a firewall or a malware cleaner, so run it alongside those; together they cover finding, blocking, and recovering.
Your printable checklist, in one place
Run through these, and you've covered the fundamentals that stop the vast majority of WordPress attacks:
Updates: Core, plugins, themes, and PHP all current; updates routine.
Plugins & themes: unused ones removed, abandoned ones replaced, sources trusted.
Users & logins: no "admin" user, strong passwords, 2FA on, and user list clean.
SSL & certificates: valid certificate, HTTPS forced, expiry monitored.
Hardening: file editor disabled, XML-RPC off if unused, sensitive files protected, firewall in place.
Backups: automated, off-site, versioned, and tested.
Monitoring: continuous vulnerability scanning, certificate and DNS monitoring, an eye on the warning signs.
Not sure where you stand against this list right now? Don't guess. A scan checks the externally visible items in minutes and tells you precisely what to fix first.
See where your site stands. The fastest way to act on this checklist is to see what an attacker sees: outdated components, certificate problems, and known vulnerabilities, all ranked so you know what to tackle first. Your first WordPress site is free to scan, no credit card required.
Secure WordPress For Free
Catch known CVEs before they are exploited. Install our plugin to run automated vulnerability checks on your themes, plugins, and core directly from your admin panel.
Free for new sign-ups · No credit card · Setup in minutes
