Security is the thing every WordPress owner hopes they will never need - until they desperately do. The good news is that the most common attacks succeed for boring, preventable reasons: weak passwords, forgotten updates, and missing backups. This checklist covers the twelve measures that make your WordPress site dramatically harder to hack.

Table of Contents

The Basics

  1. Update WordPress core, themes and plugins the moment updates are available.
  2. Use a strong, unique admin password - never 'admin' or 'password123'.
  3. Install a security plugin like Wordfence for firewall and malware scanning.
  4. Remove unused themes and plugins completely.

Securing Your Login

  1. Enable two-factor authentication (2FA) for all admin accounts.
  2. Limit login attempts to stop brute-force attacks.
  3. Change your login URL away from wp-login.php.
  4. Use a separate user for admins instead of the default 'admin' username.

Plugins and Hardening

  1. Disable file editing from the WordPress dashboard.
  2. Hide your WordPress version to avoid targeted exploits.
  3. Limit XML-RPC access if you do not use it.
  4. Install an SSL certificate so all traffic is encrypted.

Backups and Recovery

Even the best security can fail. Automated daily backups to offsite storage mean a breach becomes an inconvenience, not a catastrophe. Most good WordPress hosting plans include daily backups automatically - use them.

Frequently Asked Questions

My site was hacked. What do I do first?

Immediately change all passwords, restore the latest clean backup, update everything, and scan with a security plugin. Then ask a professional to check for backdoor files.

Does free SSL protect me from hackers?

SSL encrypts traffic - it does not stop hacks. Think of SSL as the lock on the front door and security plugins/practices as the alarm system and security guards.

Security is not a single action - it is a habit. Apply this checklist, schedule backups, and keep everything updated to stay ahead of attackers.