WordPress Security Checklist - Learn How to Secure Your Website

Intermediate

Updated September 30, 2024

We know that you care about what you build and protecting it is incredibly important. Hacks happen, and it’s your job to reduce their likelihood to the lowest probability possible. We built this checklist of best practices to help you harden your website and protect you and your users from hacks.

Hosting

Ideally on a dedicated instance or server

For shared hosting, ensure that sites are isolated or “jailed”

Run an https-only website

User Management

Grant only as much access as is needed

Review your user list frequently, deleting those that are obsolete, downgrading roles
where possible

WordPress Core, Themes and Plugins

Enable auto-updates wherever possible / practical

Check for updates frequently (at least weekly) and install them as soon as possible

Only download themes and plugins from trusted sources

Remove all unused themes, plugins and old unused WordPress installations immediately

Authentication

Ideally use 2-factor authentication

Require strong passwords for all users

Ensure that your login page is running on an https page

Limit the rate of login attempts

Server Administration

Only communicate with your server using an encrypted connection (sFTP for file transfer or SSH for shell access)

If you connect to your server over a public network, use a VPN

Secure access to your wp-config.php file, including copies

Secure access to your backups, log files, test files, temporary files and other PHP
applications on your web server

Backup your WordPress files and database at least weekly

Use a strong password for your MySQL database user

Install a WordPress security plugin like Wordfence

Features to Look for in a WordPress Security Plugin

Malware scanning

Brute-force login protection

Protection against hacker recon techniques

A WAF with regular rule-set updates

Rate based throttling and blocking

Two-factor authentication

Password auditing

Country blocking

Advanced blocking techniques

Secure Your Work Environment

Protect your internet connection by using a VPN, especially on public networks

Only install trusted software on your workstation and mobile device

Use a reputable virus scanner

Protect your devices with strong passwords

Watch out for phishing, spear phishing and social engineering attacks

Take Steps to Detect Hacks Early

Visit your site often

Search for your website in Google frequently

Set up email alerts in Google Search Console

Use a malware scanner and set up email alerts

Investigate customer reports immediately

Use a source code scanner to verify site integrity

Use a website monitoring service that detects site changes

Watch for unexplained spikes in site traffic

Download a PDF version of this checklist here.

Did you enjoy this post? Share it!

Facebook Twitter LinkedIn

1.9: Checklist – How to Secure Your WordPress Website

Hosting

User Management

WordPress Core, Themes and Plugins

Authentication

Server Administration

Features to Look for in a WordPress Security Plugin

Secure Your Work Environment

Take Steps to Detect Hacks Early

The WordPress Security Learning Center

1.9: Checklist – How to Secure Your WordPress Website

Hosting

User Management

WordPress Core, Themes and Plugins

Authentication

Server Administration

Features to Look for in a WordPress Security Plugin

Secure Your Work Environment

Take Steps to Detect Hacks Early

The WordPress Security Learning Center

Cookie Options

Strictly Necessary

Performance/Analytical

Targeting