WordPress security checklist

Not theory — the specific, ordered steps that prevent the compromises we actually clean up.

Nearly every hacked WordPress site we restore was running an out-of-date plugin. Not a zero-day, not a sophisticated attack: a known vulnerability in a plugin that had a patch available for months. Here is the list, in the order that matters.

Update everything, then turn on auto-updates

Core, themes and plugins. Then enable automatic updates for core and for any plugin you are not actively customising. On our managed WordPress plans we do this for you.

Delete what you are not using

A deactivated plugin still has files on disk, and those files are still reachable. If you are not using it, remove it. The same goes for the three default themes you never touched.

Fix your accounts

No user called "admin". No shared logins. Every account that does not need to publish should be a Subscriber or Editor, not an Administrator. Remove the developer account from that project you finished last year.

Add two-factor authentication

On every account with publishing rights. This single step stops credential-stuffing attacks dead, and it takes five minutes per user.

Lock down the file system

Directories 755, files 644, and wp-config.php at 600. Disable file editing from the dashboard by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.

Check that your backups restore

A backup you have never restored is a hope, not a plan. We keep daily copies for you, but do one test restore to a staging site so you know the process before you need it at 2am.