WordPress Security Checklist: 9 Steps That Stop Most Attacks

WordPress runs more than forty percent of the web, and that popularity is exactly what makes it a target: attackers scan constantly for known plugin holes because one exploit works on millions of sites. The good news is that the overwhelming majority of compromises do not come from breaking WordPress core — they come from simple neglect. Nine measures close most of that gap:

1. Update core, themes and plugins. Outdated plugins are the number one entry point; apply security releases within days, not months.
2. Delete unused plugins — do not just deactivate them. An inactive plugin still ships its vulnerable code to a public URL. If you do not use it, remove it.
3. Strong admin password plus two-factor authentication. The admin account is the crown jewels; a second factor turns credential stuffing and phishing into dead ends.
4. Limit login attempts. Lock the account or throttle the IP after a handful of failures — bots try thousands of passwords per hour against wp-login.php.
5. Disable the plugin and theme file editor. One line in wp-config.php — define("DISALLOW_FILE_EDIT", true); — removes a favourite attacker shortcut that turns a small foothold into full code execution.
6. Protect wp-config.php and the admin area at the web server level. Deny direct access to wp-config.php, and optionally restrict wp-admin by IP where the team is small.
7. Keep tested backups. A backup you have never restored is a hope, not a plan; verify the restore path before you need it.
8. Enforce HTTPS with HSTS. Login credentials and session cookies must never cross the network in plaintext.
9. Monitor file integrity. Compare core files against checksums and alert on unexpected changes — injected spam links and backdoors announce themselves this way.

Order matters

Work down the list in order of exposure: updates and plugin hygiene first, because they close the doors attackers actually knock on; login hardening second, because brute force runs non-stop on every WordPress site within hours of launch; file-level protections and integrity monitoring last, as the layer that limits damage when everything above failed. None of the nine requires a plugin purchase — most are settings, one config line, and a cron job for backups.

Verify from the outside

Server-side defences are only half the picture; it pays to look at your site the way an attacker does. From the outside you can see the WordPress version in the generator meta tag and feed links, and you can often spot plugin versions from public asset paths — both reveal whether you are lagging behind on releases. Third-party vulnerability databases list every plugin with a known exploit, so an outdated plugin is visible to everyone, not just to you.

The WhoDNS WordPress toolkit checks a site from the outside: it detects the core version and inspects the plugin list published by wordpress.org data, so you can spot what is outdated before an attacker does. Run it after every maintenance window, and again a week later — plugins update themselves silently through cron, and a failed auto-update is easy to miss until it becomes the hole someone walks through. Work down the nine items in order; the first three alone stop the bulk of automated attacks.

🔗 Related tool: Check a WordPress site with the WP toolkit