WordPress security checklist: what to fix first

Where attacks come from

WordPress is popular, so attackers scan for known weaknesses in outdated plugins, themes and weak passwords rather than target one site. A small business with an unmaintained site is as likely to be hit as a large one. The checks below close the common doors.

For routine care of all kinds, pair this with the website maintenance checklist.

Do now: ten minutes

Logins and users

• Every person has their own account. Never share one admin login.
• Use a password manager and a long unique password for each account
• Give people the lowest role that does the job: editors do not need admin
• Limit login attempts or add a challenge after repeated failures
• Remove accounts for people who have left, the same day
• Do not email passwords. Use a password manager share or a one-time link.

Files and server settings

• Run a PHP version that is still supported by the PHP project
• Add the line to disable the built-in theme and plugin editor in the configuration file, so a stolen login cannot rewrite code
• Set file permissions to 644 for files and 755 for folders, and keep the configuration file stricter if your host allows it
• Replace the secret keys and salts in the configuration file if you suspect a breach
• Disable XML-RPC if you do not use it, or restrict it
• Block PHP execution in the uploads folder
• Use a web application firewall from your host or a trusted plugin
• Install plugins only from sources you can verify, and avoid nulled or pirated themes completely

Backups that can save you

Keep at least three copies, in two places, with one away from the host. Test a restore every month. Backups stored only on the same server are lost when that server is compromised. Our maintenance checklist has the restore test step by step.

For stores built on WooCommerce, such as A'YUCO, keep card data off the site entirely and use a hosted payment page, so a breach cannot expose card numbers.

If the site is hacked

1. Contain itPut the site in maintenance mode or take it offline. Tell your host.
2. Take a copy firstSave the infected files and database for diagnosis, away from the live server.
3. Change every credentialWordPress users, hosting, database, FTP or SFTP, and the email accounts tied to them.
4. Restore from a clean backupChoose one from before the first sign of trouble. Update everything before going back online.
5. Look for backdoorsCheck for unknown admin users, odd files in uploads and plugin folders, and scheduled tasks you did not create.
6. Ask for review if flaggedIf a browser or search engine flagged the site, request a review once it is clean.
7. Find the causeUsually an outdated plugin or a weak login. Fix it, or the site will be hit again.

If customer personal data may have been exposed, check your reporting duties. Under GDPR that can mean telling the regulator within 72 hours.

Notes and the download

• Plugin count matters less than plugin quality and update history. Check when each was last updated.
• Security plugins help, but they do not replace updates and good logins.
• Course and membership sites such as VK Magic hold customer accounts, so treat user data with the same care as a store.

The downloadable version has a tick column, an owner and our notes on what to automate. For a security review or ongoing care, see WordPress development or contact us.