WordPress security is not a single setting or plugin. It is a routine that reduces the chance of unauthorised access, limits the damage if something goes wrong and helps you restore your website quickly. Whether you run a small business site, online publication or WooCommerce store, the following checklist covers the controls that provide the most practical protection.
You do not need to implement everything at once. Start with reliable backups, software updates and stronger account protection, then improve monitoring and recovery procedures as your site grows.
WordPress security checklist: start with the essentials
1. Keep WordPress, plugins and themes updated
Outdated software is one of the most common avoidable risks for a website. Updates can fix security weaknesses as well as bugs and compatibility problems, so review your WordPress core, plugins and themes regularly.
- Check Dashboard > Updates in WordPress and review pending updates.
- Remove plugins and themes you no longer use rather than leaving them deactivated.
- Download software only from reputable sources, such as the official WordPress directory or a verified developer.
- Test important updates on a staging site first if your website handles sales, bookings or other critical functions.
Automatic updates can be useful for some WordPress components, but they are not a complete strategy. Confirm that your hosting provider backs up the site and that important forms, payment processes and integrations still work after changes. Menu labels and update controls can vary between WordPress versions and managed hosting platforms.
2. Create and test independent backups
A backup is central to WordPress protection because it gives you a recovery option after a faulty update, accidental deletion, malware incident or hosting problem. Aim for regular backups of both the website files and the database. A database-only backup will not restore uploaded images, themes or plugins, while files alone may not restore your content and settings.
- Keep more than one recent restore point.
- Store at least one copy separately from your web server.
- Use an encrypted, access-controlled storage location where possible.
- Test a restoration periodically, ideally in a staging environment.
Do not assume a host’s backup service meets your needs without checking retention, restoration time and whether backups are isolated from the live account. A backup that has never been tested is only an expectation, not a proven recovery plan.
3. Protect administrator accounts
Use a unique, long password for every administrator account and store it in a reputable password manager. Avoid shared logins, predictable usernames and accounts that belong to former staff or contractors. Give each person an individual account so activity can be reviewed and access can be removed cleanly.
Enable multi-factor authentication (MFA) for WordPress, hosting, domain registration, email and any security service that supports it. MFA can prevent an attacker from signing in even when a password has been exposed. If your site uses single sign-on or an identity provider, apply its access policies consistently across the team.
How to secure a WordPress website day to day
Apply least-privilege access
WordPress roles should match the work a person actually needs to do. An editor may not need permission to install plugins, change themes or manage users. Review the user list through Users > All Users, confirm roles and delete or downgrade accounts that are no longer required.
Ask your developer or hosting provider to use separate staging and production access where practical. Limit access to the hosting panel, database, domain account and server files as carefully as access to WordPress itself. These connected services can be used to change or replace a site even if the WordPress dashboard is well protected.
Choose plugins and themes carefully
Every plugin and theme adds code, maintenance requirements and potential attack surface. Before installing one, check whether it is actively maintained, compatible with your WordPress environment and supplied by a developer with a clear support process. Read the documentation and understand what permissions or external services it requires.
Avoid nulled or pirated themes and plugins. They may contain hidden code, lack security updates or expose your site to legal and operational risks. Replace abandoned software rather than keeping it because it is convenient. If a feature can be removed without affecting your business, removing the related plugin may be the safest option.
Use a sensible security layer
A reputable security plugin can assist with file-change alerts, login protection, malware scanning and audit logs, depending on the product and plan. A web application firewall (WAF), provided by your host or a specialist service, may block suspicious traffic before it reaches WordPress. These tools can complement each other, but installing several overlapping security plugins may create conflicts, performance issues and confusing alerts.
Check what each service actually does, where it processes data and how alerts are delivered. Configure notifications for administrator logins, password changes, new users and significant file or configuration changes. For broader context on defensive technologies, see our guide to how artificial intelligence is changing cyber defence.
WordPress website security beyond the dashboard
Harden hosting and technical settings
WordPress website security also depends on the environment around WordPress. Use HTTPS across the entire site and renew certificates before they expire. Choose a host that provides supported PHP and database versions, account isolation, access controls, backup options and a clear process for responding to security incidents. Ask the provider which server-level protections are included rather than assuming they are enabled.
Where appropriate, restrict access to sensitive files and services, disable features you do not need and avoid exposing database credentials or configuration files. Technical hardening should be handled carefully: a misplaced server rule can break the site or interfere with updates. Take a backup and use staging before changing configuration.
Monitor activity and plan for recovery
Monitoring helps you identify suspicious behaviour before it becomes a prolonged outage. Review login activity, newly created users, unexpected redirects, changes to key pages, unusual traffic and unexplained performance problems. A sudden increase in spam, browser warnings or emails sent from your domain can also justify an investigation.
Write down who should be contacted if the site is compromised, including your hosting provider, developer and relevant business owner. Keep recovery details somewhere that is not dependent on the WordPress site itself. If you suspect an incident:
- Record what you observed and when it started.
- Contact your host or security specialist and avoid making random changes that could destroy evidence.
- Restrict affected accounts and rotate passwords from a clean device, beginning with email, hosting and domain access.
- Restore a known-clean backup only after understanding how the compromise occurred.
- Update software, remove unauthorised accounts and inspect plugins, themes and configuration before bringing the site fully online.
- Check search results, analytics, forms and payment functions after recovery.
Do not simply delete an unfamiliar file and assume the problem is solved. Persistent access may exist in another account, plugin, scheduled task or hosting credential. For serious incidents, obtain professional help and ask for a root-cause review.
A practical maintenance routine
Set a recurring calendar task for WordPress security rather than relying on memory. Weekly, review updates, backups, user accounts and critical alerts. Monthly, remove unused software, check domain and certificate renewal details, review hosting access and test important site functions. At least periodically, perform a restore test and revisit who still needs administrator privileges.
Record the date of each review and any changes made. This simple maintenance log helps a team work consistently and makes it easier to identify when an issue began.
Actionable takeaway
To secure a WordPress website, begin with three priorities: maintain tested off-site backups, update WordPress and its extensions promptly, and protect every privileged account with unique passwords and MFA. Then add least-privilege access, trusted software, suitable WAF or monitoring controls and a written recovery plan.
What to check next
- Verify that your latest backup can actually be restored.
- Review every administrator and hosting account.
- Remove unused plugins, themes and old user accounts.
- Confirm MFA, HTTPS, update notifications and incident contacts.
- Check the original WordPress, plugin, theme and hosting documentation for current settings and security guidance.
For more practical technology guidance, visit DigitalTech.com.au.
Reference: For background context, see WP Engine on Wikipedia.
