A hacked website costs you traffic, customers and trust. Fortunately, most attacks exploit simple weaknesses, and you can close them. Use this WordPress security checklist to protect your site step by step.
Why WordPress Sites Get Hacked
WordPress powers a huge share of the web, so attackers target it with automated tools. They look for outdated plugins, weak passwords and exposed login pages. Therefore, regular maintenance does most of the work. Our guide to WordPress maintenance explains what to include.
The 15-Step Checklist | WordPress security checklist
Step 1: Keep everything updated
Update WordPress core, your theme and every plugin. Updates often fix security holes, so apply them promptly. For larger updates, test on a staging copy first.
Step 2: Delete unused plugins and themes
Deactivated plugins can still be attacked. Remove anything you don’t use.
Step 3: Avoid nulled and pirated plugins
Cracked premium plugins often contain malware. Buy from official sources only.
Step 4: Use strong, unique passwords
Use a password manager and create a long, random password for every account, including hosting and email.
Step 5: Turn on two-factor authentication
Add 2FA to every admin account. As a result, a stolen password alone won’t give an attacker access.
Step 6: Don’t use “admin” as a username
Create a new administrator with a different username, then delete the default one.
Step 7: Limit login attempts
Block repeated failed logins to stop automated password guessing. Many security plugins include this feature.
Step 8: Give users the least access they need
Make most users editors or authors, not admins. In addition, remove accounts for people who no longer need access.
Step 9: Use HTTPS everywhere
Install an SSL certificate, and redirect all HTTP URLs to HTTPS.
Step 10: Back up regularly
Keep several backups, including one stored away from your server. A simple rule is three copies, on two types of storage, with one off-site. Test a restore occasionally, since an untested backup may not work.
Step 11: Add a security plugin or firewall
A reputable security plugin or web application firewall blocks known attacks and scans for malware. Choose one and keep it updated, but don’t stack several that do the same job.
Step 12: Disable file editing in the dashboard
If an attacker reaches your admin area, the built-in code editor lets them change files. Add this line to wp-config.php:
php
define( 'DISALLOW_FILE_EDIT', true );Step 13: Lock down file permissions
Set folders to 755 and files to 644. Use tighter settings, such as 600 or 640, for wp-config.php. If you’re not sure, ask your host.
Step 14: Choose secure hosting and a current PHP version
Good hosts offer firewalls, malware scanning and isolated accounts. Also run a supported PHP version, since old versions no longer receive security fixes.
Step 15: Monitor your site
Set up uptime alerts and keep an activity log. Then scan for malware regularly, and watch for unknown admin users or sudden traffic spikes.
Signs Your Site Has Been Hacked | WordPress security checklist
- Redirects to unfamiliar sites
- New admin users you didn’t create
- Pages or links you didn’t add, often about pills, casinos or loans
- A warning from Google or your browser
- A sudden slowdown
- Your host suspends the account
What to Do If You’re Hacked
- Contact your host, and take the site offline if you can.
- Change every password, including hosting, database and FTP.
- Restore a clean backup from before the infection.
- Update everything, then scan again.
- Check Search Console for security warnings and request a review.
Security Also Protects Your SEO
Hacked sites lose rankings, and Google may label them unsafe. Moreover, a slow, compromised site frustrates visitors. Keeping your site secure protects your search visibility too.
Frequently Asked Questions
Is WordPress secure?
WordPress core is actively maintained. Most breaches come from outdated plugins, weak passwords and poor hosting, not from the core itself.
Do I need a security plugin?
It helps with firewalls and scans, but it can’t replace updates, strong passwords and backups.
How often should I back up my site?
Back up daily if your site changes often, such as a store. Otherwise weekly is the minimum.
Can DDTecc handle my site’s security?
Yes. Our maintenance plans cover updates, backups and security checks. See our packages.
