A good WordPress security checklist comes down to four habits: keep WordPress, plugins, themes and PHP updated; lock down logins with strong passwords and two-factor authentication; keep tested off-site backups; and run your site on secure, current hosting with HTTPS and a firewall. Do those well and you block the attacks that hit most small business sites.
Below are 23 steps grouped by area, a printable summary table and a simple monthly and quarterly schedule. Most steps take minutes, and you only need to set many of them up once.
- Plugins are the main risk. Patchstack found that 91% of new WordPress vulnerabilities in 2025 were in plugins, 9% in themes and only 6 in WordPress core.
- Speed matters. The same report puts the weighted median time to first exploit at 5 hours after a vulnerability goes public.
- Two big flaws landed in the last few weeks: a WordPress core bug fixed in 7.1.2 and the “PHP2Shell” PHP bugs patched on 21 October 2026.
- In our own audit of 94 local business sites, 1 in 5 did not force HTTPS and 2 in 3 had no HSTS header.
- A backup you have never restored is a hope, not a plan. Test it.
Why does WordPress security matter for small businesses right now?
Attackers do not pick your site by hand. Bots scan millions of sites for known weak spots, so a small roofer or HVAC company is just as likely to be hit as a big brand. Website security for small business is mostly about not being the easy target.
Two recent events show why fast updates matter:
- WordPress core, CVE-2026-87902. On 22 September 2026, WordPress 7.1.2 fixed a critical flaw that, under certain theme and server conditions, could let an attacker run code without logging in (Pantheon release notes). The Hacker News reported attack traffic starting within hours of the patch. WordPress then shipped 7.1.3 on 6 October 2026 with 7 more security fixes, so 7.1.3 or later is the version to be on.
- PHP2Shell, CVE-2026-109618 and CVE-2026-109619. On 21 October 2026, PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 to fix two bugs that allow remote code execution with a single unauthenticated request (Help Net Security). We cover what to do in our PHP2Shell guide.
Now the checklist itself.
Updates: steps 1 to 4
1. Keep WordPress core updated
Go to Dashboard, then Updates, and make sure you are on the latest version. WordPress installs minor security releases automatically by default (WordPress.org), so check that nobody has turned that off. Apply major updates within a week or two, after a backup.
2. Update plugins quickly
Since plugins cause most problems, update them at least weekly. You can switch on auto-updates for trusted plugins from the Plugins screen. For big plugins like page builders or WooCommerce, take a backup first and check the site after the update.
3. Update your theme and delete unused themes
Keep your active theme and its parent theme updated. Delete every other theme except one default WordPress theme as a fallback. Inactive themes still sit on your server and can still be attacked.
4. Run a supported PHP version
PHP is the language WordPress runs on, and your host controls it. As of October 2026, PHP.net lists 8.2, 8.3, 8.4 and 8.5 as supported, with 8.2 losing security fixes on 31 December 2026. In our audit, 7 sites showed their PHP version publicly and 2 of those were on end-of-life 7.4 and 8.0. See our step-by-step guide to updating PHP on WordPress.
Logins: steps 5 to 9
5. Use strong, unique passwords
Every account needs a long password that is not used anywhere else. A password manager makes this painless. Change the password for your hosting account, FTP and database too, not just WordPress.
6. Turn on two-factor authentication (2FA)
With 2FA, a stolen password is not enough to log in. Free plugins such as Wordfence, Solid Security or Two Factor add app-based codes. Make it required for every administrator and editor.
7. Limit login attempts
Bots try thousands of password guesses against /wp-login.php. A security plugin or a “limit login attempts” plugin locks out an address after a few failures. Many hosts and Cloudflare can also rate-limit the login page.
8. Do not use “admin” as a username
“admin” is the first name bots guess. If you have one, create a new administrator with a different name, log in as it, then delete the old account and assign its content to the new one.
9. Remove unused users and trim roles
Delete accounts for old staff, past developers and agencies you no longer work with. Give people the lowest role they need: most staff only need Editor or Author, not Administrator.
Backups: steps 10 and 11
10. Keep automatic, off-site backups
Back up files and the database at least daily if your site changes often, weekly if it rarely does. Store copies away from your server, such as in cloud storage, so a hacked or failed server does not take your backups with it. Keep at least 30 days of history, because some infections go unnoticed for weeks.
11. Test a restore
Once a quarter, restore a backup to a staging site and click around. You want to know it works before the day you need it. If you have been hacked already, our guide on what to do when WordPress is hacked walks you through recovery.
Hosting and server hardening: steps 12 to 16
This part of the WordPress security hardening checklist is where many sites fall short, because nobody ever set it up after launch.
12. Force HTTPS and add HSTS
Your site needs an SSL certificate, a 301 redirect from http:// to https://, and no mixed content. Then add an HSTS header, which tells browsers to only ever use HTTPS for your site (MDN). In our audit of 94 Dallas and Houston business sites, 20% had no HTTPS redirect, 19% loaded mixed content and 67% sent no HSTS header.
13. Put a web application firewall (WAF) in front
A WAF filters bad requests before they reach WordPress. Cloudflare has a free plan, and many hosts include a firewall. Firewalls can buy you time when a new flaw appears: for PHP2Shell, Help Net Security reports that Cloudflare deployed initial WAF rules for the known attack methods. A firewall is not a replacement for patching, though.
14. Set correct file permissions
The WordPress file permissions guide recommends 755 for folders and 644 for files, with wp-config.php locked down further. Never set anything to 777. Your host can check this for you in a few minutes.
15. Disable the built-in file editor
WordPress lets administrators edit theme and plugin code from the dashboard. If an attacker gets into an admin account, that editor is an easy way to plant malicious code. Add this line to wp-config.php: define( ‘DISALLOW_FILE_EDIT’, true );. The WordPress hardening guide covers this and other settings.
16. Disable XML-RPC if you do not use it
XML-RPC is an older way for apps to talk to WordPress. Most small business sites do not need it, and bots use it for password guessing. Turn it off with your security plugin or at the firewall. Keep it on only if you use the Jetpack app or a tool that needs it.
Plugins: steps 17 to 19
17. Delete plugins you do not use
Deactivated plugins are still files on your server. If you are not using it, delete it.
18. Never install nulled plugins or themes
“Nulled” means a pirated copy of a paid plugin, often shared free. These often come with hidden malware and never get security updates. Buy the licence or pick a free alternative from WordPress.org.
19. Check when a plugin was last updated
Before installing anything, look at “Last updated” and “Tested up to” on its WordPress.org page. Patchstack found that 46% of vulnerabilities in 2025 had no fix from the developer in time for public disclosure, so a plugin nobody maintains is a real risk. Replace any plugin that has gone a year without updates.
Forms and spam: step 20
20. Protect your forms
Contact and quote forms attract spam bots, and spam can bury real leads. Add Cloudflare Turnstile, Google reCAPTCHA or a honeypot field. Keep your form plugin updated and do not allow file uploads unless you need them. If you do, limit file types and size.
Monitoring: steps 21 to 23
21. Run a security plugin with malware scanning
Wordfence, Solid Security, Sucuri and Patchstack all offer free tiers. Turn on scheduled scans and email alerts so you hear about changed files or known-bad plugins quickly.
22. Set up uptime monitoring
A free uptime monitor checks your site every few minutes and emails you if it goes down. Sudden downtime is often the first sign of a hack or a broken update.
23. Watch Google Search Console
Add your site to Google Search Console and check the Security issues report. Google lists hacked content and malware there and emails you when it finds a problem. If that label ever appears in your search results, follow our guide to removing the “This site may be hacked” warning.
WordPress security checklist summary table
Print this table or save it as your WordPress security audit checklist. “Once” means you set it up one time and then confirm it at each quarterly check.
| Task | How often | Difficulty |
|---|---|---|
| 1. Update WordPress core | As released (auto for minor) | Easy |
| 2. Update plugins | Weekly | Easy |
| 3. Update theme, delete unused themes | Weekly | Easy |
| 4. Supported PHP version | Quarterly check | Medium |
| 5. Strong, unique passwords | Once, then on staff changes | Easy |
| 6. Two-factor authentication | Once | Easy |
| 7. Limit login attempts | Once | Easy |
| 8. No “admin” username | Once | Easy |
| 9. Remove unused users | Quarterly | Easy |
| 10. Off-site backups | Daily or weekly (automatic) | Easy |
| 11. Test a restore | Quarterly | Medium |
| 12. HTTPS redirect and HSTS | Once | Medium |
| 13. Web application firewall | Once | Medium |
| 14. File permissions | Once, recheck after moves | Medium |
| 15. DISALLOW_FILE_EDIT | Once | Easy |
| 16. Disable XML-RPC if unused | Once | Easy |
| 17. Delete unused plugins | Monthly | Easy |
| 18. No nulled software | Always | Easy |
| 19. Check plugin last-updated dates | Quarterly | Easy |
| 20. Form spam protection | Once | Easy |
| 21. Security plugin scans | Automatic, review monthly | Easy |
| 22. Uptime monitoring | Automatic | Easy |
| 23. Search Console security issues | Monthly | Easy |
What should you check every month and every quarter?
Once the one-time steps are done, upkeep is short. Here is a simple routine.
| When | What to do | Time |
|---|---|---|
| Weekly | Apply plugin, theme and core updates. Glance at the site afterwards. | 10 minutes |
| Monthly | Review security scan results, check Search Console security issues, confirm backups ran, delete unused plugins. | 20 to 30 minutes |
| Quarterly | Test a backup restore, check PHP version, remove old users, review plugin update dates, confirm HTTPS, HSTS and 2FA are still on. | 1 to 2 hours |
| Right away | Critical security releases like WordPress 7.1.2 or the PHP2Shell fixes. | Same day |
Can you do a WordPress website audit yourself?
Yes. Most of this list is DIY-friendly if you are comfortable in the WordPress dashboard. Updates, users, 2FA, plugin cleanup and Search Console are all point-and-click jobs. Following these WordPress security best practices does not need a developer.
The harder parts are PHP upgrades, server headers like HSTS, file permissions and restore tests, because a mistake can take the site offline. If that sounds risky, ask your host, or hand it to someone who does it every week. If your site is old and patched together, it may be cheaper to rebuild than to keep fixing. Our website redesign and custom WordPress development services can build these steps in from day one.
Frequently Asked Questions
What should a WordPress security checklist include?
It should cover updates (core, plugins, themes and PHP), logins (strong passwords, 2FA, limited login attempts), off-site backups with tested restores, hosting hardening (HTTPS, HSTS, a firewall, file permissions) and monitoring through a security plugin, uptime checks and Google Search Console.
Is WordPress secure enough for a small business website?
Yes, if it is maintained. WordPress core itself had only 6 reported vulnerabilities in 2025 according to Patchstack. Most risk comes from outdated plugins and themes, weak passwords and old hosting, all of which this checklist addresses.
How often should I update WordPress plugins?
Check at least weekly and apply security updates as soon as you can. Patchstack measured a median of 5 hours from public disclosure to first exploit, so waiting a month is risky.
What PHP version should WordPress use in 2026?
Use a supported branch: 8.3, 8.4 or 8.5, with the latest patch release. PHP 8.2 still gets security fixes until 31 December 2026, so plan to move off it. After the PHP2Shell fixes, the minimum safe releases are 8.5.12, 8.4.27, 8.3.36 or 8.2.35.
How do I know if my WordPress site has been hacked?
Common signs are strange redirects, spam pages in Google results, new admin users you did not create, warnings in Search Console or your browser, and security plugin alerts. If you see any of these, follow our hacked WordPress recovery guide.
Want us to check your site for you?
If you would rather not work through 23 steps yourself, send us your website address and we will run a free website security check and tell you, in plain English, what to fix first. For ongoing peace of mind, ask about our care plans, which start from $49/month. Ask for your free security check.
