WordPress Security Checklist for Business Websites (and What to Do If You Are Hacked)

Every hacked WordPress site I have cleaned up came in through one of five doors: a plugin that had not been updated in a year, an admin password that had been used elsewhere, a pirated “premium” plugin with a backdoor, a forgotten user account, or a host with no firewall. None of them was clever. This WordPress security checklist is ordered by how often each door is used, so the first half-hour of work removes most of the risk — followed by the calm sequence to follow if you discover you have already been hacked.

It sits alongside the maintenance routine (updates and backups are security), and it starts where the migration checklist leaves off: a freshly launched site is the best moment to do all of this at once.

Priority 1: Updates (the biggest door)

• Core, plugins and themes updated within days of release for security fixes, within a couple of weeks otherwise — after a backup, on staging if you have it.
• Enable auto-updates for WordPress minor releases and for plugins you trust to be stable (form, SEO, caching); update page builders and e-commerce deliberately after reading the changelog.
• Delete, do not just deactivate, unused plugins and themes. Deactivated code is still on the server and still exploitable.
• Check each plugin’s last update date and active installs: abandoned plugins (no update in over a year) are replaced, not kept.
• Never install nulled or “GPL club” premium plugins. A large share of the backdoors I find arrive this way.

Priority 2: Logins

• Two-factor authentication for every administrator and editor. This single step defeats stolen and reused passwords.
• Unique, long passwords from a password manager. No “admin” username.
• Limit login attempts (security plugin or host feature) so brute force stops after a few tries.
• Change the login URL from /wp-login.php to something private. It does not stop a targeted attacker, but it removes the site from the automated bot sweeps that hammer the default URL all day.
• Disable XML-RPC unless something you use needs it (the mobile app, Jetpack). It is a favourite brute-force and amplification target.

Priority 3: Users

• One administrator per person who genuinely needs it; everyone else is an editor or author. Contractors get their own account, removed when the job ends.
• Review the user list quarterly; delete accounts you do not recognise and anyone who has left.
• Admin email addresses are real, monitored mailboxes — WordPress and the host send security notices there.

Priority 4: Files and configuration

Priority 5: Server and network

• A web application firewall — at the host (most managed hosts include one), via Cloudflare, or a security plugin’s firewall. It blocks known exploit patterns before they reach WordPress.
• Supported PHP version (the host’s panel shows it) — old PHP has unpatched vulnerabilities of its own.
• SSL everywhere, with http redirected to https and the site URL set to https in WordPress so no mixed content is generated.
• Isolation: on shared hosting, one site per account where possible, so a breach in one site cannot walk into another.

Priority 6: Backups and monitoring (your insurance)

• Daily off-site backups (host plus a plugin to cloud storage), retained for at least 30 days, restore tested monthly. A backup made after the breach is a backup of the breach — retention is what saves you.
• File-change monitoring: alerts when a core, plugin or theme file changes outside an update.
• Malware scanning weekly (plugin or host), plus a monthly look at Search Console for pages you did not create.
• Uptime monitoring with alerts, and an activity log showing who logged in and changed what.

If you have been hacked: the sequence

1. Do not panic and do not delete anything yet. Take a full backup of the current (infected) state for forensics and put the site in maintenance mode if it is redirecting visitors or serving spam.
2. Change every credential: WordPress admin passwords, database password (and update wp-config.php), hosting panel, SFTP, and regenerate the security keys and salts. Revoke API keys and application passwords.
3. Find the entry point before cleaning, or it will happen again: check the plugin list for anything outdated or unknown, the user list for new admins, the host’s access logs for the first suspicious request, and file modification dates.
4. Restore or clean. If a clean backup exists from before the first sign, restore it and re-apply legitimate changes. If not, replace core, plugins and theme with fresh copies from official sources and compare uploads and wp-content for PHP files that should not be there. Check the database for injected scripts in posts and options.
5. Close the door: update everything, remove the vulnerable plugin, delete unknown users, apply the checklist above.
6. Verify: scan again, crawl the site for unexpected pages and redirects, check the site as a logged-out visitor and as Googlebot.
7. Repair the aftermath: request a review in Search Console if a warning was issued, submit the sitemap, remove spam pages with the removal tool, and tell customers if their data may have been affected (a legal duty in most places).
8. Write down what happened — how they got in, what you changed — and put the missing control on the checklist.

The half-hour version

If you do nothing else this week: turn on two-factor for admins, update everything and delete unused plugins, check the user list, confirm a backup from last night exists off-site, and confirm the host’s firewall is on. That closes four of the five doors. The speed checklist and the Elementor fixes often go with this work, because a site that is looked after is both fast and safe — they are the same habit.

Further reading: Hardening WordPress (official) · WordPress: my site was hacked.

FAQ

Want the checklist applied properly, monitoring set up, and someone to call if the worst happens? See the WordPress security and care services — hardening is a one-off; the monitoring is what makes it stick.