Security advisorywp2shell: WordPress core vulnerability. Confirm every site is on 6.8.6, 6.9.5, 7.0.2, or newer.

Read the advisory

WordPress Security Checklist 2026: Complete Site Protection Guide

A practical WordPress security checklist: updates, logins, plugins, hosting, backups, scanning, and a simple order to tick things off.

Topics Hardening & checklists Beginner guides

Lars Koudal

Updated Published

Use this as a working checklist, not a brochure. Tick what you can today, schedule the rest, and revisit monthly.

WordPress security checklist

Core and updates

  • WordPress core is on the latest secure release (or scheduled to update soon)
  • Minor/security auto-updates are on if the site can tolerate them
  • Major updates are tested on staging when the site is critical
  • PHP is on a version your host still supports

Logins and users

  • No shared “team admin” account
  • No user named admin if you can avoid it
  • Unique long passwords in a password manager
  • 2FA enabled for administrators
  • Failed login limits / login protection on
  • Administrator role limited to people who need it
  • Former staff/contractor access removed

Plugins and themes

  • Only plugins you actually use are installed
  • Unused plugins and themes are deleted (not just deactivated)
  • Everything is updated, or intentionally pinned with a reason
  • No nulled / pirated “premium” packages
  • Vulnerability scan is clean (or findings are triaged)

Config and files

  • Production has debug display off (WP_DEBUG_DISPLAY false)
  • DISALLOW_FILE_EDIT is true (blocks theme/plugin editing in wp-admin)
  • File permissions are sane (no 777)
  • HTTPS is forced site-wide
  • Core files match expected WordPress copies (or differences are explained)

Hosting and edge

  • Host provides restores you understand how to use
  • Backups exist off the same server when possible
  • Cloud firewall / WAF is on if you have Pro
  • Support contact details are written down somewhere off-site
  • You know how to reach SFTP/SSH or the file manager if wp-admin dies

Backups and recovery

  • Automatic backups run on a schedule
  • Retention covers “infection started weeks ago”
  • You have restored once (or watched someone restore)
  • Backup credentials are not only stored inside the site
  • You know who to call if restore fails (hire cleanup if that is you)

See backup plan.

Monitoring

  • Malware scan scheduled or run regularly
  • Security tests reviewed after bigger changes
  • Events / alerts watched for odd logins and blocks
  • Search Console verified (helps catch Safe Browsing issues)
  • You have a habit of opening the site logged out occasionally (catches visitor-only redirects)

WooCommerce / forms (if relevant)

  • Checkout and login spam protections considered
  • Payment and shipping plugins are maintained
  • Form plugins are updated; spam protection is on

Suggested order (if starting from zero)

  1. Confirm backups
  2. Update everything; delete unused plugins/themes
  3. Fix admins, passwords, 2FA, login limits
  4. Turn on firewall + scanning if available
  5. Harden wp-config and permissions
  6. Run security tests and fix what is easy
  7. Set a monthly reminder and stick to it

Monthly revisit (10 minutes)

  • Updates pending?
  • New admins?
  • Last backup OK?
  • Any scan findings left open?

Security Ninja covers many of these checks in one place. Free for tests and vulnerability scanning; Pro for firewall, malware scanning, scheduled scans, and stronger login tools. The install wizard helps turn defaults on without guessing.

Deeper reading: hardening guide, beginners guide, login security. Already compromised? Recovery steps or hire cleanup.

Found this useful? Share it.