Scanner says core files were modified? Open the diff. After wp2shell, that is often leftover access.

How to read it

WordPress Security Checklist 2026: Complete Site Protection Guide

A printable WordPress security checklist: HTTPS, updates, passwords/2FA, backups, WAF/scans, least privilege, admin hardening, remove unused, and monitoring.

Topics Hardening & checklists Beginner guides

Updated Published

WordPress Security Checklist 2026: Complete Site Protection Guide Open larger image: WordPress Security Checklist 2026: Complete Site Protection Guide

Use this as a working checklist, not a brochure. Tick what you can today, schedule the rest, and revisit monthly. For config how-tos, see the hardening guide. For habits and routines, see best practices.

WordPress security checklist

HTTPS and transport

  • SSL/TLS certificate is installed and valid
  • HTTPS is forced site-wide (HTTP redirects to HTTPS)
  • Mixed-content warnings are cleaned up on key pages (home, login, checkout)

Core and updates

  • WordPress core is on the latest secure release (or scheduled to update soon)
  • Minor/security auto-updates are on if the site can tolerate them
  • Major updates are tested on staging when the site is critical
  • Plugins and themes are updated, or intentionally pinned with a reason
  • PHP is on a version your host still supports

Passwords, 2FA, and least privilege

  • Unique long passwords in a password manager for every privileged account
  • No shared “team admin” account
  • No user named admin if you can avoid it
  • 2FA enabled for administrators (editors too when possible)
  • Administrator role limited to people who need it (least privilege)
  • Editors/authors cannot install plugins or change settings they do not need
  • Former staff/contractor access removed

Admin and login hardening

  • Failed login limits / login protection on
  • Login URL rename considered (noise reduction only; still use 2FA + limits)
  • Production has debug display off (WP_DEBUG_DISPLAY false)
  • DISALLOW_FILE_EDIT is true (blocks theme/plugin editing in wp-admin)
  • File permissions are sane (no 777; tighten wp-config.php when the host allows)
  • Core files match expected WordPress copies (or differences are explained)

Remove unused software

  • Only plugins you actually use are installed
  • Unused plugins are deleted (not just deactivated)
  • Unused themes are deleted
  • No nulled / pirated “premium” packages
  • Vulnerability scan is clean (or findings are triaged)

Backups and recovery

  • Automatic backups run on a schedule (files + database)
  • Backups exist off the same server when possible
  • Retention covers “infection started weeks ago”
  • You have restored once (or watched someone restore)
  • Backup credentials are not only stored inside the site
  • You know who to call if restore fails (hire cleanup if that is you)

See backup plan.

WAF, scans, and monitoring

  • Cloud firewall / a WordPress firewall plugin is on if you have Pro (600M+ IP intel on Security Ninja Pro)
  • Malware scan scheduled or run regularly (and you know how to remove WordPress malware if something slips through)
  • Security tests reviewed after bigger changes
  • Events / alerts watched for odd logins and blocks
  • Search Console verified (helps catch Safe Browsing issues)
  • You open the site logged out occasionally (catches visitor-only redirects)

Hosting and access

  • Host provides restores you understand how to use
  • Support contact details are written down somewhere off-site
  • You know how to reach SFTP/SSH or the file manager if wp-admin dies
  • SFTP/SSH keys or passwords are strong and not shared casually

WooCommerce / forms (if relevant)

  • Checkout and login spam protections considered
  • Payment and shipping plugins are maintained
  • Form plugins are updated; spam protection is on

Suggested order (if starting from zero)

  1. Confirm backups
  2. Force HTTPS if it is not already
  3. Update everything; delete unused plugins/themes
  4. Fix admins, passwords, 2FA, login limits
  5. Turn on firewall + scanning if available
  6. Harden wp-config and permissions
  7. Run security tests and fix what is easy
  8. Set a monthly reminder and stick to it

Monthly revisit (10 minutes)

  • Updates pending?
  • New unexpected admins?
  • Last backup OK?
  • Any scan findings left open?
  • Events look weird?

Security Ninja is a WordPress security plugin that covers many of these checks in one place. Free for tests, vulnerability scanning, and core integrity; Pro for Cloud Firewall, malware scanning, scheduled scans, and stronger login tools. The install wizard helps turn defaults on without guessing. Comparing suites? See best WordPress security plugins.

Deeper reading: hardening guide, best practices, beginners guide, login security. Not sure if you are compromised? Check if your WordPress site is hacked. Already sure? Recovery steps or hire cleanup.

Found this useful? Share it.

Larger screenshot

Enlarged image