WordPress Security Checklist for Business Owners (Non-Technical Guide)

Short answer: Most WordPress sites are compromised through outdated plugins, weak login security, or poor hosting — not through sophisticated targeted attacks. Keeping everything updated, enabling two-factor authentication, running off-site backups you have actually tested, and removing plugins you no longer use will prevent the large majority of incidents. None of that requires technical skill.

Nobody Is Targeting You Personally

This is the most useful thing to understand, because it changes how you think about risk.

Almost all WordPress compromises are automated. Bots continuously scan the web looking for sites running a known vulnerable version of a plugin or theme, or a login page that will accept a guessed password. They do not know or care what your business does. Your site simply matched a pattern.

That is genuinely good news. Automated attacks target known weaknesses, and known weaknesses have known fixes. You are not defending against a determined expert. You are making sure your site does not appear on a list of easy matches.

Tier 1: The Non-Negotiables

If you only do four things, do these. They prevent the overwhelming majority of real-world incidents.

1. Keep everything updated

The single highest-value action you can take. Most WordPress vulnerabilities are found in plugins and themes rather than WordPress core, and the fix is almost always an update that already exists.

• Enable automatic updates for WordPress core minor releases
• Review plugin and theme updates at least monthly, and act on security releases immediately
• On a store or a site where downtime costs money, test updates on staging first rather than applying them live
• If a plugin has not been updated by its developer in over a year, treat that as a warning sign and look for an alternative

2. Secure how people log in

• Turn on two-factor authentication for every administrator account. This alone defeats password-guessing entirely
• Use a password manager so every account has a long, unique password
• Never use admin as a username
• Limit login attempts, which most security plugins handle automatically
• Remove accounts for people who have left, including former developers and agencies

3. Run backups you have actually tested

A backup you have never restored is an assumption, not a safety net. This is the difference between a bad afternoon and a catastrophe.

• Automate daily backups, or more frequently for an active store
• Store copies off-site, not only on the same server as the site
• Keep at least 30 days of history, since a compromise may not be noticed immediately
• Test a restore at least once so you know it works and roughly how long it takes

4. Choose hosting that takes security seriously

Cheap shared hosting is a common and invisible weak point. Ask your host directly whether they provide server-level firewalling, malware scanning, automatic backups, isolation from other sites on the same server, and a documented process if your site is compromised.

Tier 2: Reduce the Attack Surface

Every plugin, theme and user account is another thing that can go wrong. Less is safer.

Action	Why it matters	How often
Delete unused plugins	Deactivated plugins can still be exploitable; deletion removes the code	Quarterly
Delete unused themes	Same risk, and old default themes are often forgotten	Quarterly
Review user accounts and roles	Old accounts are a common way in	Quarterly
Give each person the lowest role they need	An editor cannot install a malicious plugin	When adding users
Confirm HTTPS is active site-wide	Protects data in transit and is a ranking factor	Once, then verify
Check for a security plugin	Adds firewalling, scanning and login protection	Once, then monitor

On roles specifically: most people who need access do not need administrator. Give contributors, editors and marketers the least access that lets them do their job. It limits the damage when an account is compromised.

Tier 3: Notice Problems Early

The cost of a compromise depends enormously on how quickly it is caught. A site cleaned within hours is an inconvenience. One left for weeks may be blacklisted by Google, flagged by browsers, and used to send spam in your name.

• Install a reputable security plugin that scans for file changes and alerts you
• Enable email alerts for administrator logins and plugin installations
• Check Google Search Console monthly for security notices
• Watch for the warning signs: unexpected redirects, unfamiliar admin users, sudden traffic drops, or customers reporting warnings
• Review your site on mobile occasionally, since some injected content only appears on specific devices

The Full Checklist

	Task	Frequency
1	WordPress core, plugins and themes updated	Monthly, security fixes immediately
2	Two-factor authentication on all admin accounts	Once, then verify
3	Unique passwords via a password manager	Ongoing
4	No account using the username admin	Once
5	Automated off-site backups running	Daily
6	Backup restore tested	Twice a year
7	Unused plugins and themes deleted	Quarterly
8	User accounts reviewed, former staff removed	Quarterly
9	Everyone on the lowest role they need	When adding users
10	HTTPS active across the whole site	Once, then verify
11	Security plugin installed and alerting	Once, then monitor
12	Search Console checked for security notices	Monthly

If You Think You Have Been Compromised

1. Do not panic and do not delete things. Evidence of how the compromise happened helps prevent a repeat.
2. Contact your host immediately. Many will scan and assist, and some can isolate the site to limit damage.
3. Change all passwords, including hosting, WordPress admin, FTP and database.
4. Take the site offline or into maintenance mode if it is showing harmful content to visitors.
5. Get professional help rather than guessing. Incomplete cleanups are common, and a site that appears fixed while a backdoor remains will simply be compromised again.
6. Once clean, request a review in Search Console if Google has flagged the site.

What You Can Do Yourself, and What Needs a Developer

You can handle	Bring in a developer
Enabling two-factor authentication	Cleaning up after a compromise
Reviewing and removing user accounts	Hardening server or file permissions
Deleting unused plugins and themes	Resolving a plugin conflict blocking updates
Applying routine updates	Setting up staging and a safe update process
Checking Search Console	Replacing an abandoned plugin with a safe alternative
Confirming backups are running	Recovering when a backup will not restore

Frequently Asked Questions

Is WordPress less secure than other platforms?

No. WordPress core is actively maintained and security issues are patched quickly. Most compromises trace back to outdated plugins and themes, weak login security, or poor hosting rather than WordPress itself. A well-maintained WordPress site is as secure as any comparable platform.

How often should I update WordPress plugins?

Review updates at least monthly, and apply security releases as soon as they appear. On a site where downtime has a direct cost, such as a store, test updates on a staging copy before applying them to the live site.

Do I really need a security plugin?

It helps, but it is not a substitute for the basics. A security plugin adds firewalling, malware scanning and login protection, which are genuinely useful. It cannot compensate for an outdated plugin, a weak administrator password, or the absence of a working backup.

What should I do first if my WordPress site is hacked?

Contact your host, then change every password including hosting, WordPress admin, FTP and database. Take the site into maintenance mode if it is showing harmful content to visitors, and get professional help with the cleanup. Incomplete cleanups often leave a backdoor in place, leading to repeat compromises.

Are automatic updates safe to enable?

Automatic updates for WordPress core minor releases are generally safe and recommended, since these are mostly security and maintenance fixes. Automatic updates for plugins carry more risk of conflicts, so on business-critical sites it is better to test those on staging first.

---

Want the security basics handled properly rather than hoping for the best? We provide vetted in-house WordPress developers, a fixed quote within 24 hours, and a 30-day bug-fix warranty. Get a free quote →