Most WordPress sites don’t get hacked because attackers are particularly clever. They get hacked because basic security measures were never put in place. After cleaning up dozens of infected sites over the years, I can tell you that the same vulnerabilities show up again and again. This checklist covers everything that should be in place before a site goes live — and everything that should be audited on sites that are already running.
1. Use a Strong, Unique Admin Password
This seems too basic to mention, but weak passwords remain one of the top reasons sites get compromised. Your WordPress admin password should be at least 16 characters, include numbers, symbols, and mixed case, and never be reused from another account. Use a password manager so you don’t have to remember it.
2. Change the Default Admin Username
If your admin account username is still “admin”, change it immediately. Automated brute force attacks target this username by default because WordPress historically set it as the default. Create a new administrator account with a different username, then delete the old “admin” account.
3. Enable Two-Factor Authentication
Two-factor authentication (2FA) adds a second layer of verification after your password. Even if someone obtains your password, they still can’t log in without your phone or authenticator app. Plugins like WP 2FA or the 2FA built into security suites like WP Ghost make this easy to set up in minutes.
4. Keep WordPress Core Updated
WordPress releases security patches regularly. Running outdated core files is one of the most common reasons sites end up with malware. Enable automatic minor updates at minimum, and check for major version updates as soon as they’re released. Test on staging before updating a live site if you’re worried about compatibility.
5. Keep All Plugins and Themes Updated
Plugins are the most frequent entry point for attackers. A vulnerability in an outdated plugin can give an attacker full control over your site. Audit your plugin list regularly — if a plugin hasn’t been updated in over a year, consider replacing it with an actively maintained alternative. Delete plugins and themes you’re not using; inactive code is still vulnerable code.
6. Never Use Nulled Plugins or Themes
Nulled plugins and themes are pirated versions of premium products, and they almost always contain hidden malware. The backdoors injected into nulled code are often obfuscated so well that standard scanners miss them. I’ve analysed several of these files myself — the payloads are real and dangerous. There is no such thing as a “clean” nulled plugin. Always purchase from official sources.
7. Hide Your WordPress Login URL
The default WordPress login URL is /wp-admin or /wp-login.php. Every bot on the internet knows this. Moving your login to a custom URL stops the vast majority of automated brute force attacks before they even reach your login form. Plugins like WP Ghost handle this without touching your files manually.
8. Limit Login Attempts
By default, WordPress allows unlimited login attempts. This makes brute force attacks trivial. Add a login attempt limiter that blocks an IP address after a set number of failed logins. Most security plugins include this feature, or you can use a dedicated plugin like Limit Login Attempts Reloaded.
9. Install a Web Application Firewall
A web application firewall (WAF) filters malicious traffic before it reaches your site. It blocks common attack patterns like SQL injection, cross-site scripting, and file inclusion attempts. WP Ghost’s 7G/8G firewall rules are a solid server-level option. For cloud-based protection, Cloudflare’s free plan offers meaningful filtering even without a premium subscription.
10. Use HTTPS with a Valid SSL Certificate
Every WordPress site should run on HTTPS. SSL encrypts data between your server and your visitors, and Google uses HTTPS as a ranking signal. Most hosting providers offer free SSL through Let’s Encrypt. Once installed, make sure all traffic is redirected from HTTP to HTTPS with no mixed content warnings.
11. Set Correct File Permissions
Incorrect file permissions are a quiet security risk that many site owners never check. The recommended settings are 644 for files and 755 for directories. Your wp-config.php file should be set to 440 or 400 to prevent it from being read by other users on a shared server. You can check and update permissions via your hosting file manager or FTP client.
12. Disable XML-RPC If You Don’t Need It
XML-RPC is a WordPress feature that allows remote connections to your site. Unless you specifically use an app or service that requires it, it should be disabled. Attackers exploit XML-RPC for brute force attacks and DDoS amplification because it allows multiple login attempts in a single request. Block it via your .htaccess file or through a security plugin.
13. Protect wp-config.php and .htaccess
These two files are among the most critical on your entire WordPress installation. The wp-config.php file contains your database credentials and security keys. The .htaccess file controls server-level behaviour. Add rules to your .htaccess to deny direct access to wp-config.php, and ensure neither file is readable by the public.
14. Take Regular Backups
Backups won’t prevent a hack, but they will save you when one happens. A recent clean backup is the fastest path to recovery after a compromise. Schedule automated backups that include both your database and all files. Store at least one copy off-server — whether that’s cloud storage, your local machine, or a remote backup service. Test your backups periodically to make sure they actually restore correctly.
15. Run Regular Malware Scans
Security is not a one-time setup — it requires ongoing monitoring. Schedule regular scans of your WordPress files to detect any unauthorised changes or injected code. Many compromises go undetected for weeks or months because no one is actively monitoring. Even a monthly manual review of recently modified files can catch infections before they cause serious damage.
Final Thoughts
Working through this checklist takes a few hours but provides lasting protection. Security is about reducing your attack surface — making your site a harder target than the next one. Most automated attacks are opportunistic, not targeted. If your site has proper protections in place, attackers will simply move on. If you need help auditing your site or implementing any of these measures, I offer WordPress security hardening as a standalone service.