A WordPress security checklist

Most WordPress sites are not hacked by someone who chose them. They are found by automated scans looking for a known weak plugin, a guessable login or an exposed file. These checks close the doors those scans look for.

Updates

1. Keep WordPress core, themes and plugins current. Most real-world break-ins use a vulnerability that already had a fix.
2. Delete plugins and themes you do not use. Deactivated code can still be attacked.
3. Replace abandoned plugins. If a plugin has not been updated in a year, look for an alternative.
4. Run a supported PHP version. See our PHP upgrade guide.

Logins and users

5. Use unique, long passwords stored in a password manager, for every account.
6. Turn on two-factor authentication for every administrator.
7. Give people the lowest role they need. An editor does not need to be an administrator.
8. Remove old accounts for staff, agencies and freelancers who no longer work on the site.
9. Limit login attempts, with a plugin or at your firewall.

Configuration

10. Turn off the file editor in the dashboard by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.
11. Serve the whole site over HTTPS and redirect plain HTTP to it.
12. Disable XML-RPC if nothing you use needs it; it is a common target for password guessing.
13. Put a web application firewall in front of the site. Cloudflare’s free plan already filters a lot of automated traffic.

Backups and monitoring

14. Keep daily backups off the server, and test a restore at least once. A backup you have never restored is a guess.
15. Watch for changes: uptime monitoring, and alerts for new administrator accounts or changed core files.

If you think you have been hacked

Put the site in maintenance mode, change every password, and restore from a clean backup taken before the problem started. Then find the way in, usually an outdated plugin, and close it, or the same thing happens again. If you need help with that, email [email protected].