WordPress Security Checklist
A WordPress security checklist is seven checks on the live site: update core, themes and plugins; replace the admin user and add two-factor login; limit login attempts; force HTTPS; disable the file editor; install only from trusted sources; and keep an off-server backup you have restored once. Nulled themes and abandoned plugins are the usual way in.
For WordPress owners, freelancers and agencies who want a short, verifiable list to harden a live or brand-new site.
knowledge
- Read time
- 3 min
- Sections
- 5
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026.
What is on a WordPress security checklist?
A WordPress security checklist covers seven areas: updates, the admin login, login protection, HTTPS, the built-in file editor, theme and plugin sources, and a backup you have restored. Work down it on the live site and fix each failed item before adding another plugin.
| Check | What to do | How to verify |
|---|---|---|
| Updates | Update core, then themes, then plugins; delete anything unused | Dashboard › Updates shows nothing pending |
| Admin account | No "admin" username; long unique password; two-factor login | Users list shows no account named admin |
| Login protection | Limit failed attempts; block XML-RPC if no tool needs it | Repeated wrong passwords trigger a lockout |
| HTTPS | Force the certificate and fix leftover http links | Padlock on every page, no mixed content |
| File editor | Set DISALLOW_FILE_EDIT to true | Theme and plugin file editors disappear from the menu |
| Sources | Themes and plugins only from WordPress.org or a vendor you pay; never nulled ZIPs | Every item has a known author and update channel |
| Backup | Off-server copy, restored once to prove it works | A staging restore opens the home page |
If you prefer this done for you, the WordPress security service covers the same list.
How do you secure the WordPress login?
Replace the default admin user with a unique name, use a long unique password, add two-factor authentication with an authenticator app, and limit failed login attempts. The login page is the door automated scripts try first.
- Rename the admin: create a new administrator, log in as it, then delete the old "admin" account and attribute its posts to the new user.
- Two-factor: prefer an authenticator app over SMS codes, and store backup codes off the server.
- Lockouts: see limiting login attempts in WordPress.
- Roles: give editors and authors only the role they need; only administrators should install plugins.
If you do not use the WordPress mobile app, Jetpack or another tool that posts through XML-RPC, block it in .htaccess on Apache or LiteSpeed:
<Files "xmlrpc.php">
Require all denied
</Files>How do you check WordPress themes and plugins for security?
Keep only themes and plugins you use, from sources that still ship updates, and turn on automatic updates for the ones you trust. Abandoned plugins and nulled premium themes are the most common way in.
Delete every inactive theme except one default fallback (see deleting a WordPress theme safely), and replace any plugin its author no longer updates. Since WordPress 5.5, each plugin and theme has an "Enable auto-updates" link on its screen. A security plugin can filter some bad requests, but it does not patch abandoned code. On ordinary WordPress hosting the host does not update your plugins unless the plan includes managed updates.
With SSH, WP-CLI can confirm core and WordPress.org plugin files match the official checksums, which quickly reveals tampered files:
wp core verify-checksums
wp plugin verify-checksums --all
wp user list --role=administrator --fields=ID,user_login,user_emailWhich wp-config.php settings harden WordPress?
Disable the dashboard file editor, keep unique security keys (salts), and make wp-config.php readable only by the account that needs it.
define( 'DISALLOW_FILE_EDIT', true );DISALLOW_FILE_EDIT stops a stolen admin session from editing PHP files in the browser. If the site was copied from another install or you suspect a breach, regenerate the salts so every existing login cookie stops working:
wp config shuffle-salts- File permissions: 755 for folders and 644 for files are the usual WordPress settings; wp-config.php can be tighter, such as 640 or 600, if your host runs PHP as your user.
- Debug off: WP_DEBUG and display_errors off on the live site, as explained in finding the WordPress error log.
What should you secure on a brand-new WordPress site?
Lock down a new install before adding client content: unique administrator with two-factor, HTTPS, file editor off and a first off-site backup.
- Create the first administrator with a unique name and long password, then enable two-factor.
- Install the certificate and set both address fields in Settings › General to https.
- Add DISALLOW_FILE_EDIT to wp-config.php.
- If the install was cloned, run
wp config shuffle-salts. - Delete the sample post, unused themes and any demo plugins the installer added.
- Take the first off-site backup.
What counts as a backup you can restore?
A usable backup contains both the database and wp-content, is stored away from the hosting account, and has been restored at least once. A backup sitting in public_html disappears with the site if the account is compromised.
Check the archive monthly and restore it to a staging site at least once a year. The 3-2-1 backup rule sets out how many copies to keep and where. If a site is already hacked, the clean-up order is in cleaning a hacked website; email support@webji.services if you need the host's copy checked.
Frequently asked questions
Does changing the wp-admin login URL make WordPress secure?
It cuts automated noise on the login page, but it is not a security control on its own. Strong passwords, two-factor login and updates still do the real work. If you move the URL, record it, because a forgotten custom URL locks you out too.
Do I need a WordPress security plugin?
It helps as an extra layer for login lockouts, firewall rules and malware scans. It does not update abandoned plugins or fix a weak admin password. Pick one security plugin; two overlapping firewalls often slow the site or lock out real users.
How often should I update WordPress plugins?
Security releases should go on within days. For routine updates, a weekly round works for most sites, tested first on staging for shops and membership sites. Auto-updates suit well-maintained plugins on simple sites.
Is a free SSL certificate enough for WordPress security?
For encrypting logins and forms, yes: free and paid certificates use the same encryption. HTTPS protects data in transit only; it does nothing against vulnerable plugins or stolen passwords.
Checked 15 November 2026 against the WordPress hardening and WP-CLI documentation · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.