--- title: WordPress security checklist canonical: https://wpsecurityninja.com/wordpress-security-checklist/ --- Use this as a working checklist, not a brochure. If you wanted an audit write-up, that is the [security audit guide](https://wpsecurityninja.com/wordpress-security-audit-guide/). Tick what you can today, schedule the rest, and revisit monthly. For config how-tos, see the [hardening guide](https://wpsecurityninja.com/wordpress-security-hardening-guide/). For habits and routines, see [best practices](https://wpsecurityninja.com/wordpress-security-best-practices/). ![WordPress security checklist](https://wpsecurityninja.com/media/2026/09/featured/wordpress-security-checklist-hero-1200x630.png) ## HTTPS and transport - [ ] SSL/TLS certificate is installed and valid - [ ] HTTPS is forced site-wide (HTTP redirects to HTTPS) - [ ] Mixed-content warnings are cleaned up on key pages (home, login, checkout) ## Core and updates - [ ] WordPress core is on the latest secure release (or scheduled to update soon) - [ ] Minor/security auto-updates are on if the site can tolerate them - [ ] Major updates are tested on staging when the site is critical - [ ] Plugins and themes are updated, or intentionally pinned with a reason - [ ] PHP is on a version your host still supports ## Passwords, 2FA, and least privilege - [ ] Unique long passwords in a password manager for every privileged account - [ ] No shared "team admin" account - [ ] No user named `admin` if you can avoid it - [ ] [2FA](https://wpsecurityninja.com/two-factor-authentication-2fa/) enabled for administrators (editors too when possible) - [ ] Administrator role limited to people who need it (least privilege) - [ ] Editors/authors cannot install plugins or change settings they do not need - [ ] Former staff/contractor access removed ## Admin and login hardening - [ ] Failed login limits / [login protection](https://wpsecurityninja.com/login-protection/) on - [ ] Login URL rename considered (noise reduction only; still use 2FA + limits) - [ ] Production has debug display off (`WP_DEBUG_DISPLAY` false) - [ ] `DISALLOW_FILE_EDIT` is true (blocks theme/plugin editing in wp-admin) - [ ] File permissions are sane (no `777`; tighten `wp-config.php` when the host allows) - [ ] [Core files](https://wpsecurityninja.com/core-scanner/) match expected WordPress copies (or differences are explained) ## Remove unused software - [ ] Only plugins you actually use are installed - [ ] Unused plugins are deleted (not just deactivated) - [ ] Unused themes are deleted - [ ] No nulled / pirated "premium" packages - [ ] [Vulnerability scan](https://wpsecurityninja.com/vulnerabilities/) is clean (or findings are triaged) ## Backups and recovery - [ ] Automatic backups run on a schedule (files + database) - [ ] Backups exist off the same server when possible - [ ] Retention covers "infection started weeks ago" - [ ] You have restored once (or watched someone restore) - [ ] Backup credentials are not only stored inside the site - [ ] You know who to call if restore fails ([hire cleanup](https://wpsecurityninja.com/consultation/) if that is you) See [backup plan](https://wpsecurityninja.com/create-backup-plan-if-site-gets-attacked/). ## WAF, scans, and monitoring - [ ] [Cloud firewall](https://wpsecurityninja.com/cloud-firewall/) / a [WordPress firewall plugin](https://wpsecurityninja.com/wordpress-firewall-plugins-guide/) is on if you have Pro (600M+ IP intel on Security Ninja Pro) - [ ] [Malware scan](https://wpsecurityninja.com/malware-scanner/) scheduled or run regularly (and you know how to [remove WordPress malware](https://wpsecurityninja.com/wordpress-malware-removal/) if something slips through) - [ ] [Security tests](https://wpsecurityninja.com/security-tests/) reviewed after bigger changes - [ ] Events / alerts watched for odd logins and blocks - [ ] Search Console verified (helps catch Safe Browsing issues) - [ ] You open the site logged out occasionally (catches visitor-only redirects) ## Hosting and access - [ ] Host provides restores you understand how to use - [ ] Support contact details are written down somewhere off-site - [ ] You know how to reach SFTP/SSH or the file manager if wp-admin dies - [ ] SFTP/SSH keys or passwords are strong and not shared casually ## WooCommerce / forms (if relevant) - [ ] Checkout and login spam protections considered - [ ] Payment and shipping plugins are maintained - [ ] Form plugins are updated; spam protection is on ## Suggested order (if starting from zero) 1. Confirm backups 2. Force HTTPS if it is not already 3. Update everything; delete unused plugins/themes 4. Fix admins, passwords, 2FA, login limits 5. Turn on firewall + scanning if available 6. Harden `wp-config` and permissions 7. Run security tests and fix what is easy 8. Set a monthly reminder and stick to it ### Monthly revisit (10 minutes) - [ ] Updates pending? - [ ] New unexpected admins? - [ ] Last backup OK? - [ ] Any scan findings left open? - [ ] Events look weird? [Security Ninja](/) is a [WordPress security plugin](/) that covers many of these checks in one place. Free for tests, vulnerability scanning, and core integrity; Pro for Cloud Firewall, malware scanning, scheduled scans, and stronger login tools. The [install wizard](https://wpsecurityninja.com/install-wizard/) helps turn defaults on without guessing. Comparing suites? See [best WordPress security plugins](https://wpsecurityninja.com/best-wordpress-security-plugins/). Deeper reading: [hardening guide](https://wpsecurityninja.com/wordpress-security-hardening-guide/), [best practices](https://wpsecurityninja.com/wordpress-security-best-practices/), [beginners guide](https://wpsecurityninja.com/wordpress-security-beginners-guide/), [login security](https://wpsecurityninja.com/wordpress-login-security-complete-guide/). Not sure if you are compromised? [Check if your WordPress site is hacked](https://wpsecurityninja.com/signs-wordpress-site-is-hacked/). Already sure? [Recovery steps](https://wpsecurityninja.com/what-should-you-do-if-your-wordpress-site-is-hacked/) or [hire cleanup](https://wpsecurityninja.com/consultation/). ## Related reading - [WordPress security for beginners](https://wpsecurityninja.com/wordpress-security-beginners-guide/) - [WordPress security hardening guide](https://wpsecurityninja.com/wordpress-security-hardening-guide/) - [WordPress security best practices](https://wpsecurityninja.com/wordpress-security-best-practices/) - [WordPress login security guide](https://wpsecurityninja.com/wordpress-login-security-complete-guide/) - [Best WordPress security plugins](https://wpsecurityninja.com/best-wordpress-security-plugins/) - [WordPress security guide hub](https://wpsecurityninja.com/wordpress-security-guide/) - [Security audit guide](https://wpsecurityninja.com/wordpress-security-audit-guide/)