sanjeevkumarmalik.in

WordPress Security Checklist for Business Websites

Most hacked WordPress sites weren’t targeted by anyone. A bot found an outdated plugin, a reused password or an exposed login page, and walked in. This WordPress security checklist covers the fixes that close those doors: keep plugins patched, lock down logins, put a firewall in front of the site, keep tested off-site backups, and watch for changes. Do these five things well and you’ve dealt with the large majority of real-world risk.

What follows is ordered by how much risk each item removes, not by how technical it sounds.

WordPress Security Checklist

WordPress Security Checklist: Why WordPress Sites Get Compromised

WordPress core is maintained by a large security team and is rarely the weak point. The usual entry points are:

  • Plugins and themes, especially abandoned ones or “nulled” (pirated) premium copies, which often ship with backdoors
  • Weak or reused passwords on admin, hosting and FTP accounts
  • Shared hosting with poor account isolation, where one infected site on the server can spread to its neighbours
  • Old PHP versions that no longer receive security fixes
  • Leftover access: a former developer’s admin account, a staging site nobody remembers

A bot doesn’t care whether you run a five-page brochure site or a store with daily orders. It scans for known weaknesses at scale. So “we’re too small to be a target” is not a defence.

WordPress Security Checklist for Plugin Vulnerabilities

Most WordPress compromises trace back to a plugin or theme. Managing them properly is the single highest-value habit on this list.

Audit what’s installed. Deactivated plugins still sit on the server and can still be exploited if they contain a flaw. Delete anything you don’t use, including the default themes you aren’t running.

Check each plugin before you install it. Look at when it was last updated, whether the developer responds to support threads, and its active installs. A plugin untouched for two years is a liability, however popular it once was.

Update on a schedule, not “when I remember”. Security patches for plugins are often released with public details, which means attackers start scanning for unpatched sites within days. For small updates, enabling auto-updates for trusted plugins is reasonable. For major version jumps on a store or a site with custom code, test on a staging copy first. A broken checkout is also a business problem.

Use a vulnerability feed. Tools like Wordfence, Patchstack and WPScan publish known vulnerabilities by plugin and version. Subscribe to one so you hear about a flaw in a plugin you actually use, rather than finding out from the attacker.

Never use nulled themes or plugins. The saving is not worth it. This is one of the most common ways malware gets onto a business site.

WordPress Security Checklist for Login Security

The WordPress login page is the most-attacked URL on most sites, usually through automated password guessing.

  • Use strong, unique passwords for every admin, editor and hosting account, kept in a password manager
  • Turn on two-factor authentication (2FA) for all administrator and editor accounts. This alone defeats most credential-stuffing attacks
  • Limit login attempts or add rate limiting so a bot can’t try thousands of passwords
  • Don’t use “admin” as a username. It’s the first one bots try
  • Give people the lowest role they need. A content writer doesn’t need Administrator access
  • Remove accounts for people who’ve left, including former freelancers and agencies
  • Disable XML-RPC if you don’t use it. It’s an older interface that attackers abuse for brute-force attempts
  • Add CAPTCHA or a challenge to login and comment forms if spam and bot traffic are heavy

Changing the login URL (for example away from /wp-admin) can cut down log noise, but treat it as a minor extra. It’s obscurity, not protection. 2FA and rate limiting do the real work.

WordPress Security Checklist for Firewall Protection

A web application firewall (WAF) filters malicious requests such as SQL injection attempts, known exploit patterns and abusive bots before they hit your site. There are two main types:

Type

How it works

Good to know

DNS/cloud-level WAF (e.g. Cloudflare, Sucuri)

Traffic is filtered before it reaches your server

Stops attacks early and reduces server load

Plugin-level WAF (e.g. Wordfence)

Runs inside WordPress itself

Easier to set up, but malicious requests still reach your server

For a business site, a cloud-level WAF is generally the stronger option, since blocked traffic never touches your hosting. Pair it with rate limiting on the login page and you’ve covered a lot of ground. Whichever you pick, configure it properly. A firewall installed on default settings and never reviewed gives less protection than people assume.

WordPress Security Checklist for Secure Hosting

Your host is part of your security. When comparing options, check whether they offer:

  • Account isolation, so another customer’s infected site can’t reach yours
  • Current PHP versions (and the ability to upgrade). Running unsupported PHP means no security fixes
  • Server-level firewall and malware scanning
  • Free SSL and automatic renewal
  • SFTP/SSH access rather than plain FTP, which sends credentials unencrypted
  • Daily backups stored away from the same server (more on this below)
  • A clear, fast process if the site is compromised

Very cheap shared plans are where you most often see cross-site contamination. If the site earns money or collects leads, hosting is not the place to cut costs.

Core WordPress hardening: configuration and file-level steps

These are the settings that make a compromise harder to exploit and easier to contain.

  1. Force HTTPS sitewide and redirect all HTTP traffic.
  2. Disable the built-in file editor so an attacker who gets into the dashboard can’t edit plugin code directly. Add define(‘DISALLOW_FILE_EDIT’, true); to wp-config.php.
  3. Set correct file permissions. Commonly folders are 755 and files 644, with wp-config.php more restricted. Your host can confirm what’s right for their setup.
  4. Protect wp-config.php. It holds your database credentials. Keep it out of public access, and regenerate the security keys and salts if you suspect a breach.
  5. Block PHP execution in the uploads folder, where attackers frequently hide malicious files.
  6. Change the default database table prefix on new installs, and use a unique database user with only the permissions it needs.
  7. Add security headers such as HSTS, X-Content-Type-Options and a sensible Content-Security-Policy, to reduce clickjacking and script-injection risk.
  8. Turn off directory listing so visitors can’t browse your folders.
  9. Hide unnecessary version information where practical, so scanners learn less about what you’re running.

Not every item matters equally. If you only do three from this list, do HTTPS, the file editor lock and the uploads-folder restriction.

Backup strategy: the safety net when everything else fails

Security is about reducing risk. Backups are what save you when something still goes wrong. A backup plan that works has four traits:

  • It’s automatic. A backup you must remember to run won’t be there when you need it
  • It’s stored off the server. If backups live on the same hosting account, ransomware or a server failure takes them out too. Use cloud storage or a separate service
  • It keeps multiple restore points. Malware is sometimes found weeks after it arrived, so yesterday’s backup may already be infected. Keep daily copies for a couple of weeks at least, plus a few older ones
  • It’s been tested. Actually restore a backup to a staging site at least occasionally. Plenty of owners discover their backups are incomplete or corrupted only at the worst moment

Back up both the database (your content, orders and users) and the files (themes, plugins, uploads). For busy ecommerce sites, the database may need much more frequent backups than a brochure site.

Monitoring and malware protection

You can’t respond to what you don’t see. Set up:

  • Scheduled malware scans that compare core files against known-good versions and flag unexpected changes
  • Activity logging for logins, new users, plugin installs and settings changes. If an unknown admin appears at 3am, you want a record
  • Uptime monitoring with alerts, so downtime or defacement doesn’t go unnoticed
  • Google Search Console alerts, which will warn you about hacked content or malware flagged on your domain

Security also has a visibility side. A hacked site can be flagged by browsers and search engines, and injected spam pages can damage the rankings you’ve built. If you’re working on being cited in AI-generated answers as well, see our guide on AI Overviews & WordPress SEO, where site trust and clean technical health come up again.

A simple maintenance rhythm

How often

What to do

Daily (automated)

Backups, malware scans, uptime checks

Weekly

Review plugin and theme updates, check security alerts

Monthly

Review user accounts and roles, check logs for odd activity

Quarterly

Test a backup restore, audit installed plugins, review firewall rules, confirm PHP version

What to do if your WordPress site is hacked

Stay calm and work in order:

  1. Don’t just delete the visible damage. The malware usually has a hidden backdoor that will bring it back
  2. Put the site in maintenance mode or take it offline if it’s serving spam or harming visitors
  3. Change every password: WordPress admins, hosting, database, FTP/SFTP and email
  4. Restore from a clean backup taken before the infection, then update everything immediately
  5. Scan again and look for unknown admin users, strange scheduled tasks and modified core files
  6. Find the entry point. If you don’t identify how they got in, you’ll be hacked again
  7. Request a review in Google Search Console if the site was flagged

If the site handles customer data or payments, get professional help rather than going it alone.

Frequently Asked Questions

1. Is WordPress secure enough for a business website?

Yes, when it’s maintained properly. WordPress core is regularly patched and powers a huge share of the web. Most breaches come from outdated plugins, weak passwords and poor hosting, not from the platform itself.

Vulnerable or abandoned plugins and themes are the most common entry point, followed by weak or reused passwords and compromised hosting accounts.

It helps, but a plugin isn’t a complete solution. A security plugin adds scanning, login protection and firewall rules, yet it works best alongside timely updates, strong credentials, good hosting and off-site backups.

Check weekly. Apply security updates as soon as you reasonably can, and test major updates on a staging site first if your site is a store or has custom functionality.

For administrator and editor accounts, yes. It blocks most password-guessing and stolen-credential attacks even when a password has leaked.

A plugin firewall runs inside WordPress, so bad requests still reach your server. A cloud firewall filters traffic before it arrives, which usually blocks attacks earlier and reduces server load.

Keep several restore points, for example daily copies for a couple of weeks plus a few older ones, stored away from your hosting server. Test restoring from them occasionally.

It can. Hacked sites may be flagged with warnings, have spam pages injected or be removed from results. Cleaning the site and requesting a review in Search Console helps recovery.

It can be, if the host provides proper account isolation, current PHP versions and server-level protection. Very cheap shared plans with weak isolation carry more risk, especially for business sites.

Warning signs include unknown admin users, sudden redirects, strange pages or links appearing, a browser security warning, a sudden traffic or ranking drop, or your host suspending the account. A malware scan and a review of your user list are the quickest first checks.

Want a second pair of eyes on your WordPress site's security?

If you’re not sure whether your site would pass this checklist, I’m happy to take a look. I’m Sanjeev Kumar Malik, and I work on WordPress and website development for businesses. Have a look at my website development services to see how I work, or call/WhatsApp me on 9718604362 and we can go through your site’s security setup together.

Scroll to Top