WordPress security checklist: protect your site in layers

WordPress security checklist: cover every layer

An infected site can send a prospective customer to a scam, replace your phone number or interfere with checkout. Search warnings and spam pages can also disrupt how people find and trust the business. Security belongs beside the lead and sales journey in our WordPress web design guide.

• Control who can change things

  Give each person their own account and only the access their job requires. Include hosting, email and domain accounts in the review.

• Protect the machine too

  WordPress runs inside a larger environment. Someone must own operating system updates, server access, isolation and investigation of suspicious processes.

• Keep a way back

  Maintain independent recovery copies and test them. A backup stored only inside the compromised hosting account may be lost with the site.

WordPress security checklist: updates and cleanup

Keep WordPress core, plugins and themes supported and current. Review security fixes promptly, with backups and testing proportionate to the risk; a monthly calendar is no reason to leave an urgent vulnerability unattended.

Remove what the business no longer needs

List each plugin's purpose, source and maintenance status, then remove unused plugins and themes after checking dependencies. Retain a supported fallback theme if your recovery process needs one. Never install nulled plugins or themes, which are unauthorized copies with an untrusted supply chain.

Use our WordPress updates guide for the backup, staging and verification process. Testing should include the pages that generate business: forms, bookings, checkout and account access where used.

define('DISALLOW_FILE_EDIT', true);

The official WordPress hardening guide explains this setting and the wider approach. Keep legitimate code changes in a controlled deployment process, with a record of what changed and a recovery copy.

Secure accounts, HTTPS and the web firewall

Use long, unique passwords stored in a password manager, and enable two-factor authentication (2FA) for privileged accounts. Protect the recovery email as carefully as WordPress: access to that inbox can let someone reset other accounts.

• Use the smallest suitable role

  A writer usually needs an editorial role, not Administrator. Remove departed users, preserve their content ownership and review temporary supplier access when the job ends.

• Limit repeated login attempts

  Use rate limiting or lockouts with a tested recovery route for legitimate staff. WordPress core does not include 2FA; arrange it through an appropriate plugin or identity provider.

• Filter suspicious web requests

  A web application firewall (WAF) can filter attack traffic before vulnerable code handles it. Test its rules against forms, uploads, payments and integrations so legitimate customers can still act.

The WordPress brute-force guidance covers stronger login controls. Apply account protection to the hosting panel, registrar and backup destination as well, and store recovery codes securely outside the site.

Wordfence, Solid Security, Sucuri and Patchstack are real options to evaluate for your security setup. Compare the current plan, hosting compatibility, alert handling and responsibilities; their products and coverage differ. Installing several overlapping tools does not establish better protection.

Server security a WordPress plugin may miss

A security plugin normally operates within its WordPress or PHP permissions. It cannot reliably inspect every operating system process, another site's private files or a privileged attacker's changes. Ask who maintains the server, even when the hosting is called managed.

On a VPS, arrange operating system security patches and unattended security upgrades where appropriate, with failure alerts and planned restarts. Ubuntu's automatic-update documentation explains that configuration and reboot handling still require attention. Do not assume a package installer proves that running services use the patched version.

Check the live PHP branch against PHP's supported versions, then test a supported replacement on staging when needed. For SSH, prefer individual keys, protect private keys and disable password access only after testing a working key and a recovery route.

Look for miners and persistent access

Unexplained sustained CPU use, unknown processes or unfamiliar cron jobs can indicate a hidden crypto miner or other compromise. They can also have legitimate causes, so correlate processes, owners, scheduled tasks and logs before stopping anything. Server-level malware scanning and log monitoring complement the WordPress checks.

WordPress hacked? Signs worth investigating

An attack may leave the homepage looking normal for you while showing something different to search visitors or phones. Treat unexpected changes as evidence to investigate, without assuming every outage or slow page means a hack.

• Spam pages or redirects

  Google shows unfamiliar titles, or a service page sends visitors elsewhere. Save the affected URL, screenshot and the route used to reach it.

• Accounts nobody recognizes

  A new administrator, changed recipient address or unexplained access setting deserves immediate review. Confirm it with the people authorized to make changes.

• Unexpected executable files

  Unexplained PHP in uploads or modified core files can be a backdoor. Preserve a copy and compare against trusted files before deleting anything.

• Host or resource warnings

  Suspension, malware alerts, unusual outbound mail or sustained high CPU need investigation. Ask the host for the affected paths, timestamps and logs.

How to fix a hacked WordPress site: first actions

Start these actions in the first hour; full investigation and recovery can take longer. Follow the priorities in the WordPress hacked-site guidance, with one incident owner coordinating your host and maintainer.

1. Step 1

   Stay calm and record the symptoms

   Do not panic-delete files or repeatedly reinstall plugins. Record affected URLs, warning messages, the discovery time and recent changes; use a trusted device for recovery work and tell the responsible business or agency contact.

2. Step 2

   Contain the compromised site

   Ask the host to restrict public access or serve a clean maintenance page outside the affected WordPress installation. Pause malicious redirects, outgoing spam and suspect jobs as safely as possible; a maintenance plugin alone may leave malicious files reachable.

3. Step 3

   Preserve logs and a quarantined copy

   Capture files, database and relevant access, error and authentication logs before cleanup. Mark this snapshot as potentially infected, restrict access and keep it apart from clean recovery backups; record each action taken.

4. Step 4

   Secure every access point

   Change all relevant passwords, including WordPress, hosting, SFTP, database, email and domain access, from a trusted device. Revoke unauthorized users, sessions, keys and tokens; coordinate configuration changes to avoid breaking connections, and rotate secrets again after cleanup if they could have been exposed.

5. Step 5

   Choose clean restoration or qualified cleanup

   Validate a backup from before the compromise or clean the site in an isolated environment. Preserve newer legitimate orders and inquiries separately, and check restored files and data before reopening; restoring yesterday's infected backup repeats the problem.

6. Step 6

   Find and close the entry point

   Investigate vulnerable software, stolen access and server issues, then patch or replace the cause. If the server was compromised, include its users, processes and scheduled tasks in recovery; confirm forms, checkout and email work afterward.

7. Step 7

   Address Google warnings and monitor

   After removing the harmful content and fixing the cause, request a security review in Search Console if Google flagged the site. Document the repair and keep watching for returning files, new accounts and unexpected traffic; a review is not an instant recovery guarantee.

Use the Google Search Console Security issues report to understand the warning and review requirements. Check the broader affected site, not just the example URLs Google lists.

WordPress malware removal needs verification

Cleanup should cover files, database content, users, scheduled tasks and server persistence. A backdoor is a way to regain access after the visible problem disappears; removing a spam page alone can leave that route open.

wp core verify-checksums

The WP-CLI checksum command compares core files with the published checksums for their version. A passing result does not clear uploads, plugins, themes, the database or the operating system; inspect those separately.

Ask for a short incident record: affected areas, confirmed findings, repairs, tests and remaining uncertainty. That record makes follow-up maintenance meaningful and helps your agency explain the work without claiming that every possible threat has been ruled out.

Monthly WordPress security checklist

Use this review alongside ongoing monitoring and prompt security updates. Record the date, result and responsible person for each item, with a next action for anything unresolved.

Use our WordPress backups guide to plan recovery copies and the maintenance checklist for the wider schedule. After security changes, confirm delivery with the WordPress email guide, since an intact form still needs to reach your inbox.

What WordPress security services should cover

A WordPress security service needs a named person responsible for alerts and a clear boundary between the maintainer and host. When comparing managed WordPress security services, ask whether server checks, incident cleanup, backups and post-recovery testing are included or quoted separately.

Ask for scope and evidence

Request an initial inventory, agreed access, monitoring responsibilities and a plain-language record of work. Confirm contact hours and escalation, because a reply commitment is different from a guaranteed repair time. Avoid agreements built around an impossible promise that you can never be hacked.

Our WordPress maintenance service starts from $250 per month per site, with a fixed written quote before work. Tell us your host, site functions and current concerns through contact; active compromise needs its own assessment and agreed recovery scope.