# WordPress security checklist: protect your site in layers

> A WordPress security checklist covers updates, access, firewalls, server protection, monitoring and tested recovery. Protect both WordPress and the machine running it: a clean dashboard cannot tell you whether someone has compromised the server underneath. The business goal is to keep inquiries, orders and your reputation out of an attacker's hands.

Canonical: https://fer.marketing/wordpress-security-checklist
Author: Fernando Marcano, Fer Marketing
Updated: 2026-10-17

- **Coverage:** WordPress, server and recovery
- **Access:** Unique passwords, 2FA, limited roles
- **Response:** Alerts with a named owner
- **Recovery:** Independent backups, tested restores

## WordPress security checklist: cover every layer

An infected site can send a prospective customer to a scam, replace your phone number or interfere with checkout. Search warnings and spam pages can also disrupt how people find and trust the business. Security belongs beside the lead and sales journey in our [WordPress web design guide](https://fer.marketing/wordpress-web-design).

*Diagram: People and logins, WordPress software, the server, network filtering and monitoring each protect a different part of the site.*

- **Control who can change things.** Give each person their own account and only the access their job requires. Include hosting, email and domain accounts in the review.
- **Protect the machine too.** WordPress runs inside a larger environment. Someone must own operating system updates, server access, isolation and investigation of suspicious processes.
- **Keep a way back.** Maintain independent recovery copies and test them. A backup stored only inside the compromised hosting account may be lost with the site.

> **No honest 100% security promise:** Layers reduce risk and limit damage; they do not make a website impossible to compromise. A useful plan states what is checked, who receives alerts and how recovery will be verified.

## WordPress security checklist: updates and cleanup

Keep WordPress core, plugins and themes supported and current. Review security fixes promptly, with backups and testing proportionate to the risk; a monthly calendar is no reason to leave an urgent vulnerability unattended.

### Remove what the business no longer needs

List each plugin's purpose, source and maintenance status, then remove unused plugins and themes after checking dependencies. Retain a supported fallback theme if your recovery process needs one. Never install nulled plugins or themes, which are unauthorized copies with an untrusted supply chain.

Use our [WordPress updates guide](https://fer.marketing/wordpress-updates) for the backup, staging and verification process. Testing should include the pages that generate business: forms, bookings, checkout and account access where used.

**Disable dashboard file editing in wp-config.php** (correct)

```
define('DISALLOW_FILE_EDIT', true);
```

Have your maintainer edit the existing configuration before the stop-editing comment, without duplicate definitions. This disables the built-in plugin and theme file editors; it does not block every way to change files.

The [official WordPress hardening guide](https://developer.wordpress.org/advanced-administration/security/hardening/) explains this setting and the wider approach. Keep legitimate code changes in a controlled deployment process, with a record of what changed and a recovery copy.

## Secure accounts, HTTPS and the web firewall

Use long, unique passwords stored in a password manager, and enable two-factor authentication (2FA) for privileged accounts. Protect the recovery email as carefully as WordPress: access to that inbox can let someone reset other accounts.

- **Use the smallest suitable role.** A writer usually needs an editorial role, not Administrator. Remove departed users, preserve their content ownership and review temporary supplier access when the job ends.
- **Limit repeated login attempts.** Use rate limiting or lockouts with a tested recovery route for legitimate staff. WordPress core does not include 2FA; arrange it through an appropriate plugin or identity provider.
- **Filter suspicious web requests.** A web application firewall (WAF) can filter attack traffic before vulnerable code handles it. Test its rules against forms, uploads, payments and integrations so legitimate customers can still act.

The [WordPress brute-force guidance](https://developer.wordpress.org/advanced-administration/security/brute-force/) covers stronger login controls. Apply account protection to the hosting panel, registrar and backup destination as well, and store recovery codes securely outside the site.

Wordfence, Solid Security, Sucuri and Patchstack are real options to evaluate for your security setup. Compare the current plan, hosting compatibility, alert handling and responsibilities; their products and coverage differ. Installing several overlapping tools does not establish better protection.

> **HTTPS protects the connection:** Keep a valid certificate, redirect HTTP to HTTPS and test renewal alerts. Encryption protects data in transit; an encrypted page can still contain malicious code if the site itself is compromised.

## Server security a WordPress plugin may miss

A security plugin normally operates within its WordPress or PHP permissions. It cannot reliably inspect every operating system process, another site's private files or a privileged attacker's changes. Ask who maintains the server, even when the hosting is called managed.

| Area | What to confirm | Why it matters |
| --- | --- | --- |
| OS updates | Patches + restart plan | Close server flaws |
| PHP | Supported branch | Receive security fixes |
| SSH | Keys + access review | Restrict remote access |
| Firewall | Needed ports only | Reduce exposed services |
| Site isolation | Separate system users | Limit spread |
| Monitoring | Processes, files, logs | Find hidden activity |

On a VPS, arrange operating system security patches and unattended security upgrades where appropriate, with failure alerts and planned restarts. [Ubuntu's automatic-update documentation](https://ubuntu.com/server/docs/how-to/software/automatic-updates/) explains that configuration and reboot handling still require attention. Do not assume a package installer proves that running services use the patched version.

Check the live PHP branch against [PHP's supported versions](https://www.php.net/supported-versions.php), then test a supported replacement on staging when needed. For SSH, prefer individual keys, protect private keys and disable password access only after testing a working key and a recovery route.

### Look for miners and persistent access

Unexplained sustained CPU use, unknown processes or unfamiliar cron jobs can indicate a hidden crypto miner or other compromise. They can also have legitimate causes, so correlate processes, owners, scheduled tasks and logs before stopping anything. Server-level malware scanning and log monitoring complement the WordPress checks.

> **Isolation needs real permissions:** Separate system users, restricted file access and separate database credentials help contain damage between sites. If an attacker controls the server administrator account, cleaning one WordPress folder is insufficient; assess rebuilding the affected environment from trusted sources.

## WordPress hacked? Signs worth investigating

An attack may leave the homepage looking normal for you while showing something different to search visitors or phones. Treat unexpected changes as evidence to investigate, without assuming every outage or slow page means a hack.

- **Spam pages or redirects.** Google shows unfamiliar titles, or a service page sends visitors elsewhere. Save the affected URL, screenshot and the route used to reach it.
- **Accounts nobody recognizes.** A new administrator, changed recipient address or unexplained access setting deserves immediate review. Confirm it with the people authorized to make changes.
- **Unexpected executable files.** Unexplained PHP in uploads or modified core files can be a backdoor. Preserve a copy and compare against trusted files before deleting anything.
- **Host or resource warnings.** Suspension, malware alerts, unusual outbound mail or sustained high CPU need investigation. Ask the host for the affected paths, timestamps and logs.

> **Want someone watching both security layers?** Our WordPress maintenance plans start from $250 per month per site. We agree WordPress checks, server monitoring access and escalation responsibilities in a fixed written quote. https://fer.marketing/services/wordpress-maintenance

## How to fix a hacked WordPress site: first actions

Start these actions in the first hour; full investigation and recovery can take longer. Follow the priorities in the [WordPress hacked-site guidance](https://wordpress.org/documentation/article/faq-my-site-was-hacked/), with one incident owner coordinating your host and maintainer.

1. **Stay calm and record the symptoms.** Do not panic-delete files or repeatedly reinstall plugins. Record affected URLs, warning messages, the discovery time and recent changes; use a trusted device for recovery work and tell the responsible business or agency contact.
2. **Contain the compromised site.** Ask the host to restrict public access or serve a clean maintenance page outside the affected WordPress installation. Pause malicious redirects, outgoing spam and suspect jobs as safely as possible; a maintenance plugin alone may leave malicious files reachable.
3. **Preserve logs and a quarantined copy.** Capture files, database and relevant access, error and authentication logs before cleanup. Mark this snapshot as potentially infected, restrict access and keep it apart from clean recovery backups; record each action taken.
4. **Secure every access point.** Change all relevant passwords, including WordPress, hosting, SFTP, database, email and domain access, from a trusted device. Revoke unauthorized users, sessions, keys and tokens; coordinate configuration changes to avoid breaking connections, and rotate secrets again after cleanup if they could have been exposed.
5. **Choose clean restoration or qualified cleanup.** Validate a backup from before the compromise or clean the site in an isolated environment. Preserve newer legitimate orders and inquiries separately, and check restored files and data before reopening; restoring yesterday's infected backup repeats the problem.
6. **Find and close the entry point.** Investigate vulnerable software, stolen access and server issues, then patch or replace the cause. If the server was compromised, include its users, processes and scheduled tasks in recovery; confirm forms, checkout and email work afterward.
7. **Address Google warnings and monitor.** After removing the harmful content and fixing the cause, request a security review in Search Console if Google flagged the site. Document the repair and keep watching for returning files, new accounts and unexpected traffic; a review is not an instant recovery guarantee.

Use the [Google Search Console Security issues report](https://support.google.com/webmasters/answer/9044101?hl=en) to understand the warning and review requirements. Check the broader affected site, not just the example URLs Google lists.

> **Set a useful incident update:** Tell the business what is affected, what is contained, what remains unknown and when the next update will arrive. If customer information may have been exposed, involve the appropriate incident and privacy specialists.

## WordPress malware removal needs verification

Cleanup should cover files, database content, users, scheduled tasks and server persistence. A backdoor is a way to regain access after the visible problem disappears; removing a spam page alone can leave that route open.

**Ask your maintainer to verify core files**

```
wp core verify-checksums
```

Run from the intended installation with trusted tooling and appropriate access. This comparison reports differences in WordPress core; it is not a cleanup command or a complete malware scan.

The [WP-CLI checksum command](https://developer.wordpress.org/cli/commands/core/verify-checksums/) compares core files with the published checksums for their version. A passing result does not clear uploads, plugins, themes, the database or the operating system; inspect those separately.

**Do: verify the whole recovery**
- Preserve evidence and compare suspicious files.
- Replace affected software from trusted sources.
- Close the entry point and check for persistence.
- Retest customer actions and monitor afterward.

**Don't: hide the visible symptom**
- Delete unfamiliar files without investigation.
- Trust a single green scan as final proof.
- Restore without checking the backup's date and state.
- Reopen while the same vulnerable access remains.

Ask for a short incident record: affected areas, confirmed findings, repairs, tests and remaining uncertainty. That record makes follow-up maintenance meaningful and helps your agency explain the work without claiming that every possible threat has been ruled out.

## Monthly WordPress security checklist

Use this review alongside ongoing monitoring and prompt security updates. Record the date, result and responsible person for each item, with a next action for anything unresolved.

**Review evidence, not just dashboard badges**

- [ ] Review software and outstanding fixes.: Check core, plugin and theme versions, unused components, trusted sources and deferred updates. Give each unresolved security issue an owner and review date.
- [ ] Audit users and recovery access.: Confirm roles, 2FA, former staff removal and temporary supplier accounts. Test access to hosting and independent backups without putting passwords in the report.
- [ ] Review WordPress and server findings.: Inspect scan results, file changes, login events, unusual processes and cron jobs. Match alerts to planned work and investigate unexplained activity.
- [ ] Check server support and filtering.: Confirm PHP and operating system support, patch status, restart needs, SSH access and firewall rules. Review site isolation with the hosting administrator.
- [ ] Verify backups and practice recovery.: Confirm matching files and database reach an independent destination. Schedule isolated restore tests and document the most recent successful result.
- [ ] Test alerts and the customer journey.: Confirm an accountable person receives alerts, then submit forms and test bookings or checkout. Check HTTPS renewal and investigate new Search Console warnings.

Use our [WordPress backups guide](https://fer.marketing/wordpress-backups) to plan recovery copies and the [maintenance checklist](https://fer.marketing/guides/wordpress-maintenance-checklist) for the wider schedule. After security changes, confirm delivery with the [WordPress email guide](https://fer.marketing/wordpress-not-sending-email), since an intact form still needs to reach your inbox.

## What WordPress security services should cover

A WordPress security service needs a named person responsible for alerts and a clear boundary between the maintainer and host. When comparing managed WordPress security services, ask whether server checks, incident cleanup, backups and post-recovery testing are included or quoted separately.

### Ask for scope and evidence

Request an initial inventory, agreed access, monitoring responsibilities and a plain-language record of work. Confirm contact hours and escalation, because a reply commitment is different from a guaranteed repair time. Avoid agreements built around an impossible promise that you can never be hacked.

> **A technical partner for agencies too:** Fer Marketing was founded by Fernando Marcano, an IT engineer with 20+ years of hands-on IT experience. Agencies can arrange white-label delivery, staging on their domain, and NDA and non-solicitation terms.

Our [WordPress maintenance service](https://fer.marketing/services/wordpress-maintenance) starts from $250 per month per site, with a fixed written quote before work. Tell us your host, site functions and current concerns through [contact](https://fer.marketing/contact); active compromise needs its own assessment and agreed recovery scope.

## Want us to handle both security layers?

We can configure a maintenance plan around your site and hosting, from $250 per month per site. You receive a fixed written quote defining access, monitoring and recovery responsibilities before work starts.

- Core, plugin and theme updates with backup and testing
- User roles, 2FA, login limits and compatible WAF rules
- Server patch, PHP, process and log monitoring where access permits
- Independent backups, restore tests and incident escalation
- A plain-language report, with white-label delivery for agencies

https://fer.marketing/services/wordpress-maintenance

## FAQ

### What should a WordPress security checklist include?

Include supported software, safe updates, limited user roles, unique passwords, 2FA, HTTPS, a web firewall, server maintenance, monitoring and independent backups. Assign each task and alert to a person, and verify that recovery works.

### My WordPress was hacked. What should I do first?

Record the symptoms and contact your host and maintainer. Contain public access if the site is harming visitors, preserve logs and an infected copy, and secure all access points from a trusted device before coordinated recovery.

### Can I fix a hacked WordPress site by restoring a backup?

Only if the backup is verified clean and the entry point is closed. Preserve newer orders and inquiries, inspect the restored site and include the server in the investigation where needed; otherwise the infection can return.

### Does a security plugin protect my VPS too?

A plugin's visibility is limited by its permissions and design. It generally cannot replace operating system patches, SSH protection, site isolation, process inspection or server log monitoring. Confirm who owns those checks with your host.

### Which WordPress security plugin should I choose?

Wordfence, Solid Security, Sucuri and Patchstack are options to evaluate. Compare current coverage, hosting compatibility, your existing tools and who will investigate alerts. There is no single product that removes the need for updates, access control and recovery.

### What should WordPress malware removal include?

Include investigation of the entry point, affected files and database, unauthorized accounts, backdoors and scheduled tasks. Close the cause, rotate exposed access, test business functions and monitor afterward. A clean core checksum result is only one check.

### How much do Fer Marketing's security maintenance plans cost?

WordPress maintenance plans start from $250 per month per site. We agree the monitoring, server access, recovery responsibilities and any incident work in a fixed written quote before starting. Agencies can arrange white-label delivery.

### How do I remove a Google security warning after cleanup?

Read the Security issues report in Search Console, fix the reported problem across the site and request a review once cleanup is complete. Explain what was repaired and continue monitoring. Review timing and search recovery are not guaranteed.

Send your site to fer@fer.marketing for a fixed written quote, with maintenance from $250 per month per site, same-business-day replies from 9 AM to 9 PM ET and white-label delivery for agencies.