How to Secure a WordPress Site: 21-Point Small-Business Checklist

Know your enemy: how WordPress sites actually get hacked

Understanding the attack paths keeps you from wasting effort. Almost every compromise we clean up for BC businesses entered through: a known vulnerability in an outdated or abandoned plugin/theme (the largest share by far), weak or reused admin credentials without 2FA, outdated WordPress core or PHP, or a compromised neighbour on badly isolated shared hosting. Everything below maps to closing those doors.

The 21-point checklist

Group 1: Access control (points 1–5)

1. Strong, unique passwords for every account — generated by a password manager, never reused from other services. Most “WordPress hacks” are just a password reused from a breached site elsewhere.
2. Two-factor authentication on all administrator accounts. A free plugin (Wordfence Login Security, Two-Factor) plus a phone app closes the door on stolen passwords entirely.
3. Limit login attempts. Out of the box, WordPress lets bots try passwords forever. A rate-limiting plugin turns brute force from viable to pointless.
4. No “admin” username. It is the first username every bot tries. Create a new administrator with a non-obvious name and delete (or demote) the old one.
5. Least-privilege roles. Content writers are Editors, not Administrators. Every unnecessary admin account is an extra set of keys that can be phished. Review the user list monthly and remove departed staff the day they leave.

Group 2: Update discipline (points 6–9)

6. Keep WordPress core current. Minor releases (security fixes) should auto-update — WordPress does this by default; confirm nobody disabled it.
7. Update plugins and themes promptly — security releases within days, the rest in a monthly pass after a backup. This is the single highest-value habit on the page; the full routine lives in our WordPress maintenance checklist.
8. Delete deactivated plugins and themes entirely. Deactivated code still executes on many attack paths. If you don’t use it, it should not be on the server.
9. Avoid abandoned plugins. Before installing, check the last update date and tested-up-to version. A plugin untouched for two years is a future vulnerability with no fix coming. Nulled (pirated premium) plugins are malware delivery, full stop.

Group 3: Hosting and backups (points 10–13)

10. Put a WAF in front of the site. A web application firewall (Cloudflare, or your host’s) blocks exploit attempts before they reach WordPress — including many attacks against plugins you haven’t updated yet.
11. SSL everywhere and a current PHP version. Old PHP is both slow and unpatched; check the version in your hosting panel and stay on a supported release. Quality managed WordPress hosting handles both by default — and proper account isolation, which is what protects you from hacked neighbours on shared servers.
12. Daily automated backups, stored off the web server. Backups on the same server die with the server. Cloud storage or host-managed off-site copies, retained for at least 30 days.
13. Test a restore quarterly. An untested backup is a hope. Restoring to a staging site once a quarter proves the safety net is real — this is the most skipped point on the list and the one that saves businesses.

Group 4: Hardening (points 14–18)

14. Disable file editing in the dashboard: add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php. If an attacker gets admin access, this blocks the easiest path to planting code.
15. Disable XML-RPC if you don’t use it (most sites don’t — it mainly serves the mobile app and Jetpack). It is a favourite amplifier for brute-force attacks.
16. Turn off comments where you don’t need them — Settings → Discussion, or per-post. Unmoderated comments become spam-link dumps that hurt trust and SEO; if you do want comments, use anti-spam protection and moderation.
17. Send basic security headers (X-Frame-Options, X-Content-Type-Options, a starter Content-Security-Policy) via your host, Cloudflare, or a plugin. Cheap defence-in-depth against click-jacking and injected-content tricks.
18. Check file permissions: directories 755, files 644, wp-config.php 640 or stricter, and nothing world-writable. Wrong permissions turn any small breach into full compromise.

Group 5: Monitoring (points 19–21)

19. Run scheduled malware and file-integrity scans (Wordfence, or server-side scanning from your host) so injected code is found in days, not months.
20. Monitor uptime with alerts. A free uptime monitor tells you about defacement or downtime before a customer does.
21. Review users and activity monthly. Unknown admin accounts, unexpected role changes, or logins at strange hours are the early smoke of a compromise — the same signals we flag in reset-email investigations that turn out to be security incidents.

If you have already been hacked

Signs: Google flags the site, customers report redirects or spam, unknown admin users appear, or the site throws the critical error screen with no recent changes. What to do — and not do:

1. Don’t delete things randomly. Half-removed malware regenerates from backdoors you missed, and destroyed evidence makes professional cleanup slower.
2. Take the site into maintenance mode or password-protect it at the host level to stop harm to visitors.
3. Change every credential — WordPress admins, hosting, database, SFTP — from a clean device.
4. Preserve a copy of the infected state (yes, back up the hacked site) so the entry point can be identified.
5. Clean properly or get it cleaned: core reinstall, plugin reinstall from source, database inspection, user audit, and the entry point closed — the full sequence of a professional hacked WordPress cleanup. Restoring an old backup without closing the hole just schedules the next incident.

When to go beyond the checklist

This checklist is the right scope for a small-business marketing site. Raise the bar — professional monitoring, hardening review, and incident planning — when the site takes payments, stores client records, serves a regulated profession, or when downtime costs real revenue per hour. That tier is what our cybersecurity services cover, and it starts with exactly this checklist done properly, not with buying tools.