Securing a WordPress website is easier when you treat it as a repeatable process rather than a one-time plugin installation. This checklist covers the main controls to configure at the hosting, WordPress, administrator, backup, and monitoring levels, plus a practical schedule for checking that those controls still work.
Overview
A secure WordPress setup reduces the chance that a stolen password, vulnerable plugin, hosting error, or failed update will take your site offline or expose its data. No single setting provides complete protection. Instead, security comes from several independent layers that limit access, detect problems, and make recovery possible.
Start with the hosting account because it controls the environment in which WordPress runs. Then secure administrator accounts, enable HTTPS, review installed software, configure backups, and test recovery. Once the site is live, use a monthly review and a deeper quarterly audit to confirm that these measures remain effective.
Your hosting plan also affects the work involved. Managed WordPress hosting may include automated updates, staging, backups, or malware monitoring, while shared, VPS, and cloud plans may require more manual configuration. Before choosing or changing a plan, compare the actual security controls rather than relying on the hosting label. Our WordPress hosting setup checklist provides a related launch guide.
What to track
1. Protect the hosting account first
The hosting control panel, billing account, domain registrar, and server access can provide broader control than a WordPress administrator account. Use a unique password for each service and enable multi-factor authentication wherever it is available. Keep recovery email addresses and phone numbers current, and remove former users from hosting, registrar, and support accounts.
Review which users have access to the hosting panel, SFTP, SSH, databases, and deployment tools. Give each person only the access needed for their role. Avoid sharing a single administrator login because individual accounts make access reviews and incident investigation easier.
Confirm that your hosting provider supports a currently supported PHP version and lets you update WordPress components safely. If you are unsure which resources your site is using, check CPU, memory, storage, inode, and bandwidth limits. Resource problems can interrupt updates and backups; see the web hosting resource limits guide for a troubleshooting framework.
2. Review WordPress users and authentication
Open the Users screen and remove unused accounts, old contractors, test accounts, and duplicate administrators. Give contributors and editors the lowest role that allows them to do their work. Keep the number of administrator accounts small, and review administrator activity after major site changes.
Require strong, unique passwords and multi-factor authentication for administrators and other users with publishing or financial access. A password manager can help users create and store distinct credentials. Do not rely on changing a username alone to protect a site; account security should be based on strong authentication, limited privileges, and monitoring.
Protect the email accounts associated with WordPress and hosting recovery. If an attacker controls that mailbox, password resets may bypass otherwise careful WordPress settings.
3. Confirm HTTPS and secure connections
Verify that the site loads over HTTPS and that the WordPress Address and Site Address use the intended secure URL. Check the homepage, login page, contact forms, images, scripts, and stylesheets for mixed-content warnings. A certificate can be valid while individual resources still load insecurely.
Test the site after changing DNS, moving hosts, or renewing a certificate. Confirm that the HTTP version redirects to HTTPS without creating a redirect loop. If visitors see certificate errors, follow a structured check of DNS, certificate coverage, server configuration, and cached redirects. The SSL certificate troubleshooting checklist covers those areas.
4. Keep core, themes, and plugins under review
Remove plugins and themes that are inactive, abandoned, duplicated, or no longer needed. Deactivation is not the same as removal: unused files can still increase maintenance and may remain a source of confusion. Download extensions from reputable sources, check their documentation and update history, and avoid installing several tools that perform the same function.
Enable automatic updates where they fit the site’s risk tolerance and test process. Automatic updates can reduce the time a site runs outdated software, but important business sites should still have recent backups and a way to check forms, checkout flows, login, and key pages after changes. Test updates on a staging copy when the host provides one, particularly when several plugins interact.
Keep WordPress core, the active theme, and PHP aligned with supported versions. Before changing PHP or a major plugin, check compatibility and create a restorable backup.
5. Build backups that can actually restore the site
A backup strategy should cover both the WordPress files and the database. Files commonly include the active theme, plugins, media uploads, and configuration files; the database contains posts, pages, settings, users, and other site content. Backing up only one of these components may not produce a usable site.
Store copies separately from the live hosting account when practical. Define how often backups run, how long they are retained, and who can access them. Keep at least one backup from before major updates or migrations. Protect backup storage with strong access controls because backups may contain personal information, credentials, or private business data.
Do not assume a successful backup job proves that recovery will work. Restore a copy in a staging environment or temporary location, check the database connection, open representative pages, test media, and confirm that administrators can sign in. Record the restoration steps so another authorized person can follow them.
6. Monitor the site and limit common attack paths
Use a security or monitoring tool only when you understand what it checks and how alerts are delivered. Monitor unexpected administrator accounts, file changes, failed logins, unusual redirects, broken certificates, and sudden performance changes. Enable login protection such as rate limiting or other controls offered by your host or security tool, but avoid stacking several overlapping systems without testing them.
Review file permissions and ownership through the hosting panel or an administrator who understands the server. WordPress files should not be broadly writable without a clear reason. Never paste unverified code into configuration files, themes, or a code-injection plugin. Keep database credentials out of public documents and restrict database access to the services that need it.
Security checklist: risk, prevention, and verification
| Common risk | Preventative action | Verification step |
|---|---|---|
| Stolen hosting credentials | Use a unique password, multi-factor authentication, and limited user access. | Review active users and sign-in or security logs monthly. |
| Outdated software | Remove unnecessary extensions and apply tested core, theme, plugin, and PHP updates. | Check update status and test important site functions after updates. |
| Lost or corrupted site data | Back up files and the database to separate storage. | Perform a test restore at least quarterly and after major changes. |
| Insecure connections | Use HTTPS and correct mixed-content or redirect problems. | Open key URLs in a private browser window and inspect certificate warnings. |
| Excessive privileges | Use role-based access and remove unused accounts. | Compare current users with the people who still need access. |
| Undetected compromise | Monitor file changes, login activity, redirects, and malware alerts. | Confirm that alerts reach a monitored mailbox and have an assigned response. |
Cadence and checkpoints
Use a simple maintenance rhythm so security tasks do not depend on memory.
Before launch or immediately after a migration
- Secure the hosting, domain, and WordPress accounts with unique credentials and multi-factor authentication.
- Remove test users, unused themes, plugins, and temporary files.
- Confirm HTTPS, redirects, DNS, and email-related settings.
- Create a fresh backup and test that it can be opened or restored.
- Record the host, registrar, administrator accounts, backup location, and recovery contacts.
DNS changes can affect both the website and email. For a record-by-record explanation, use DNS Records Explained. If the site is moving hosts, keep a written migration plan and rollback option; the WordPress migration checklist can help organize the process.
Monthly review
- Check WordPress, theme, plugin, and PHP update status.
- Review administrator accounts, hosting users, and recent login activity.
- Confirm that backups completed and that monitoring alerts are working.
- Open the homepage, login, contact forms, search, and other revenue-critical pages.
- Check certificate status, redirects, storage usage, and unusual performance changes.
Quarterly audit
- Restore a backup in a safe staging or temporary environment.
- Remove obsolete plugins, themes, users, API keys, and SFTP or SSH accounts.
- Review file permissions, database access, backup retention, and recovery documentation.
- Reassess whether the hosting plan has sufficient resources and appropriate security controls.
- Run a controlled vulnerability or malware review using tools you trust, then investigate results rather than automatically deleting files.
How to interpret changes
Not every alert indicates a compromise, and not every quiet dashboard indicates a secure site. Interpret changes in context. A failed backup after a plugin update may point to storage limits, a changed database password, or a permissions problem. A sudden increase in failed logins may be broad automated activity, but it still justifies checking account security and login protections. An unexpected redirect, new administrator, or modified file deserves faster investigation.
Keep a short change log for updates, DNS edits, hosting moves, new users, and configuration changes. It helps separate an expected change from an unexplained one. When a site behaves differently, first preserve a recent backup and note the time of the problem. Avoid repeatedly changing settings while troubleshooting because that can erase useful evidence or make recovery harder.
If you suspect a compromise, limit further access, contact the hosting provider or a qualified security professional, rotate affected credentials from a clean device, and identify a known-good restore point. Do not treat restoring a backup as the complete response; determine how access was gained and update the exposed credentials or software before bringing the site fully back online.
When to revisit
Use this checklist before launching a site, after installing a plugin or theme, when changing PHP or hosting, after a domain or DNS change, and following any security alert. A monthly review is appropriate for routine checks; perform a deeper quarterly audit that includes a test restore. Revisit the checklist immediately when WordPress core, a major hosting panel, or a critical site component changes its update or authentication behavior.
To make the process practical, create a recurring calendar task with five deliverables: an updated user list, an update review, a backup confirmation, a small functional test, and a note of anything that changed. Mark each item as verified rather than simply assuming it is configured. If the site is business-critical, keep a second person familiar with the recovery process and review the plan before planned migrations or major releases.
Security is strongest when it is maintained alongside ordinary WordPress operations. Pair this guide with the monthly and quarterly hosting maintenance checklist, and update your own records whenever the site, hosting environment, or responsible users change.
