The WordPress Security Checklist

Updated October 28, 2026

The practical steps that keep a WordPress site from getting hacked — passwords, updates, backups, and more. A plain-English security checklist.

0 of 9 done

The basics (start here)

Keep WordPress, your theme, and all plugins up to dateOut-of-date plugins and themes with a known hole are one of the most common ways sites get hacked.
Use strong, unique passwords for WordPress, hosting, and email
Turn on two-factor authentication for your admin login

Lock the doors

Limit failed login attempts to shut down brute-force bots
Make sure your site uses HTTPS with a valid SSL certificate
Remove unused plugins, themes, and old admin accounts

Be ready for the worst

Run automatic daily backups, stored separately from your siteA clean, recent backup is what turns a hack into an inconvenience instead of a disaster.
Add a security layer that scans for and blocks threats
Know who to call if something does get through

None of this requires being technical — it requires being consistent, which is the hard part when you are busy running a business. If keeping on top of it is more than you want to think about, that is exactly the kind of ongoing protection we handle.

Related terms

Rather have it handled for you?

The WordPress Security Checklist

The basics (start here)

Lock the doors

Be ready for the worst

Security & Malware Cleanup