Last updated: October 23, 2026
A practical WordPress security checklist should tell you what to check, who owns the task and what evidence shows it is complete. Installing a plugin is one task. Confirming that your host patches PHP, your backups restore and former staff no longer have access are separate jobs.
This guide is for owners of blogs, small business sites and online stores. It is a prevention and maintenance plan, not a claim that a site has passed a security audit. The recommendations below are an editorial synthesis of official documentation, not results from testing your server.
Start here: your WordPress security checklist
| Area | What to confirm | Evidence to keep |
|---|---|---|
| Hosting | Supported, patched PHP and server software | Provider confirmation for your domain |
| Updates | Current core, themes and plugins | Update record and function checks |
| Access | Named accounts, appropriate roles and MFA | Account review with an owner |
| Backups | Files and database can be restored | A successful restore test |
| Monitoring | Alerts reach someone who can act | Test notification and response contact |
1. Check hosting security before dashboard scores
Your site relies on software outside WordPress. Ask your hosting provider who maintains PHP, the web server and operating-system packages, and how emergency security releases reach your account. Write down the answer instead of assuming a managed plan covers every layer.
For the October 2026 PHP flaws, see our PHP2Shell vulnerability guide for fixed versions and what to ask your host.
For several domains on one account, ask whether each uses the same PHP configuration. Include staging sites and old installations in the inventory. A forgotten copy can create work that your main site’s dashboard never shows. If you are moving to a new host anyway, check current Hostinger coupon codes before you pay, and still ask the new provider the same PHP patching questions.
2. Make updates a repeatable process
The WordPress hardening handbook recommends maintaining software and reducing unnecessary exposure. Keep the active theme, WordPress core and installed extensions maintained. Remove unused components through normal admin workflows after confirming they are not dependencies.
Before an important change, identify your backup and recovery contact. Afterwards, check the features that matter to your business: logins, forms, search and checkout. Keep a short update record with the date, change and result. This makes troubleshooting much faster.
Routine automatic updates can help, but someone still needs to review failures and compatibility problems. Decide who checks alerts when you are away.
3. Protect the accounts that can change your site
Use individual accounts so activity can be attributed to the right person. Give each person the access their work needs. Review administrators, hosting accounts, domain management and the email account used for recovery.
Enable multi-factor authentication where supported. WP 2FA’s official listing, for example, documents authenticator methods, role policies and backup codes. Store recovery information securely and test the normal recovery process before relying on it.
When an agency contract ends or a team member leaves, include website access in the handover checklist. Ask about separate SFTP, hosting and service accounts too. Removing one WordPress user may leave other access paths in place.
4. Prove that backups restore
A backup notification answers whether a job reported success. A restore test answers whether you can recover a usable site.
Choose a recovery point and restore it into an isolated test environment with your provider or developer. Check that pages load, media exists and the database contains the expected content. Record how long the exercise took and which credentials were needed.
Keep the backup system separate from everyday editing access where practical. Decide what data you can afford to lose between backups. A brochure site and a busy store may need different recovery arrangements; use your actual publishing and order activity to make that decision.
5. Choose security tools for specific jobs
List the gaps first: malware detection, login protection, file-change alerts or firewall coverage. Then compare products against that list. Our WordPress security plugins comparison explains the differences and limitations.
A tool is only useful if its alerts reach a responsible person. Send a test email, confirm the recipient can sign in and agree who handles a warning. Document exclusions and allowlists so they can be reviewed later.
Avoid enabling overlapping controls simply to raise a score. Introduce one change at a time, check your important workflows and keep a recovery route available. If the host already provides a control, ask how it interacts with the plugin.
6. Separate suspicious activity from routine maintenance
If you find an unknown administrator, unexpected redirect or malware warning, stop treating the task as an ordinary checklist. Record the symptom and time, preserve relevant logs and contact the host. Use our WordPress malware removal guide to organize the response.
Do not delete unfamiliar files just because their names look strange. Ask a qualified responder to establish whether they belong to the application. A hurried cleanup can erase useful evidence or break legitimate features.
A workable maintenance schedule
The following is a suggested operating routine, not a universal security standard. Adjust it to your site and support arrangement.
- After changes: test the visitor workflows affected by the update.
- Weekly: review update failures, backup notifications and security alerts.
- Monthly: review privileged accounts and unused extensions.
- After major changes: repeat a restore exercise and update the recovery notes.
- During a critical advisory: contact the responsible provider promptly rather than wait for the routine cycle.
Frequently asked questions
Can I secure WordPress without a security plugin?
Some protections come from the host, account configuration and maintenance process. Identify what is covered before adding software. A plugin can fill gaps, but it does not replace the other layers.
Does a green security score prove my site is safe?
No. It describes the checks performed by that product. Keep evidence of patching, access reviews and recovery tests as well.
Should I change file permissions from an online checklist?
Ask your host which ownership and permission model is appropriate. Blindly applying values can break the site or create access problems.
What should a nontechnical owner do first?
Name a maintenance contact, confirm patching responsibilities and arrange a backup restore test. These steps turn a vague security promise into tasks someone owns.
Make every check accountable
Use this checklist as a working record. Add an owner, completion date and evidence beside each item. The goal is a website you can maintain and recover, with a clear person to contact when something changes.