How to Secure Your WordPress Website (10-Step Checklist)

WordPress Security Checklist

WordPress powers over 40% of the web, making it a prime target for hackers. Follow this checklist to secure your site.

1. Use a Strong Admin Password

• Minimum 16 characters
• Mix of uppercase, lowercase, numbers, and symbols
• Never use "admin" as your username
• Change the default admin username: Users → Add New → create new admin → delete old "admin" user

2. Keep WordPress, Themes, and Plugins Updated

1. WordPress admin → Dashboard → Updates
2. Update WordPress core, all themes, and all plugins
3. Enable automatic updates: add to wp-config.php:

define('WP_AUTO_UPDATE_CORE', true);

3. Install a Security Plugin

Wordfence Security (free):

1. Plugins → Add New → search "Wordfence"
2. Install and activate
3. Complete the setup wizard
4. Enable the Firewall and Malware Scanner

4. Enable Two-Factor Authentication

1. Install WP 2FA plugin
2. Require 2FA for all administrator accounts
3. Use Google Authenticator or Authy app

5. Limit Login Attempts

Wordfence includes this. Alternatively, install Limit Login Attempts Reloaded:

• Lock out after 5 failed attempts
• Lockout duration: 20 minutes

6. Change the WordPress Login URL

The default /wp-admin URL is targeted by bots. Install WPS Hide Login to change it to a custom URL (e.g., /my-secret-login).

7. Disable XML-RPC

XML-RPC is a common attack vector. Add to .htaccess:

<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

8. Set Up Automatic Backups

Install UpdraftPlus:

1. Plugins → Add New → search "UpdraftPlus"
2. Install and activate
3. Settings → UpdraftPlus Backups → Settings
4. Schedule: Daily backups, keep 7 copies
5. Remote storage: Google Drive or Dropbox (free)

9. Install an SSL Certificate

Ensure your site runs on HTTPS. See our [SSL installation guide](#).

10. Harden wp-config.php

Add these security keys to wp-config.php:

// Disable file editing from WordPress admin
define('DISALLOW_FILE_EDIT', true);

// Disable plugin/theme installation
define('DISALLOW_FILE_MODS', true);

// Force SSL for admin
define('FORCE_SSL_ADMIN', true);

After a Hack — Recovery Steps

If your site is already hacked:

1. Take it offline immediately (rename public_html to public_html_hacked)
2. Run Wordfence malware scan
3. Restore from a clean backup
4. Change all passwords (WordPress, cPanel, FTP, database)
5. Contact our support team for server-level malware scanning