WordPress Security Audit: A 25-Point Checklist to Protect Your Site

A WordPress security audit is a regular check of what attackers rely on: who can log in, whether your software is current, how your hosting is set up, whether your backups work, and whether anyone would notice a problem. Work through the 25-point WordPress security checklist below every few months, fixing logins and updates first.

If you only do three things today, turn on two-factor login for every administrator, update or delete every out-of-date plugin, and confirm you have a recent backup stored away from your server.

How do you run a WordPress security audit?

Work through the checklist section by section and note every item that fails. Tools > Site Health in your dashboard is a good first stop: it flags an outdated PHP version, pending plugin updates and error messages shown to visitors.

Repeat the audit whenever someone with access leaves or a developer finishes work on the site. WordPress's own hardening guide has the technical background.

What should a WordPress security checklist include?

It should cover six areas: accounts and logins, updates, hosting, backups, monitoring and, for online stores, payments.

Accounts and logins

• 1. Everyone has their own login, with the lowest role that fits. Shared logins hide who changed what, and a stolen Editor account can do far less than an Administrator.
• 2. No account is called "admin". It is one of the first usernames bots try. Create a new administrator, then delete the old account and attribute its content to the new one.
• 3. Stale access is removed. Delete accounts for former staff, past developers and tests, and look for administrators you do not recognize, one sign of a hack. Revoke application passwords (logins that let apps connect to your site) nobody uses.
• 4. Passwords are long and unique. A password manager makes this painless. A reused password is only as safe as the weakest site that stores it.
• 5. Two-factor login is on for every administrator. WordPress does not include it, so you add it with a plugin (see below).
• 6. Failed logins are limited. WordPress itself never locks anyone out. Your host, a firewall service or a security plugin can rate-limit logins. If nothing uses XML-RPC, an older way for apps to connect (Jetpack and some mobile apps still do), switch it off: it is a frequent target for password guessing.
• 7. Sign-ups are closed unless you need them. Under Settings > General, leave "Anyone can register" unticked unless visitors need accounts, and keep the New User Default Role at Subscriber.

Updates and software

• 8. WordPress itself is current. At the time of writing (October 2026) that is version 7.1.2, and 7.1.1 alone fixed 11 security issues. Security releases install automatically on most sites, so check that nothing has switched this off.
• 9. Plugins and themes are updated within days. Patchstack found that 91% of the 11,334 new WordPress vulnerabilities recorded in 2025 were in plugins and 9% in themes. Auto-update simple plugins, and test checkout, form and page builder updates on a staging copy first.
• 10. Unused plugins and themes are deleted, not just deactivated. Deactivated code still sits on your server, flaws included. Keep one default WordPress theme, which WordPress falls back to if yours breaks.
• 11. Every plugin and theme comes from a trusted, active source. Never use a "nulled" copy of a paid product, which you cannot trust or update. On WordPress.org, a plugin not tested with the latest three major releases may be abandoned.

Hosting and server

• 12. PHP is a supported version. PHP is the language WordPress runs on, and WordPress recommends PHP 8.3 or newer. PHP 8.1 and older get no security fixes, and fixes for PHP 8.2 end on December 31, 2026.
• 13. The whole site runs on HTTPS, and the certificate renews itself. HTTPS protects logins and form entries in transit. Certificate lifetimes are shrinking to a maximum of 47 days by 2029, so renewal has to be automatic.
• 14. You connect with SFTP, and the hosting login is protected. SFTP encrypts file transfers; plain FTP sends your password unencrypted. Give the hosting account a unique password and two-factor login if your host offers it.
• 15. File permissions are tight. Nothing should be writable by everyone (permission 777), and wp-config.php, which holds your database password, should be readable only by you and the web server. Your host can check this.
• 16. wp-config.php has the safe settings. The DISALLOW_FILE_EDIT line removes the dashboard's code editors, often an attacker's first tool after logging in. Error messages should also stay hidden from visitors; Site Health warns when they are not.
• 17. A firewall filters bad traffic. A web application firewall blocks common attacks before they reach vulnerable code, either as a plugin or in the cloud. Our comparison of Wordfence, Sucuri and Kadence Security explains the difference.

Backups

• 18. Files and the database are backed up automatically. A copy of your files does not include the database, where posts, users and orders live. WordPress suggests weekly backups for quiet sites and daily for busy ones.
• 19. Several copies are kept away from your server. WordPress recommends three to five recent backups in different places, so you still have a clean one if a hack goes unnoticed for a week or two.
• 20. A restore has been tested. A backup you have never restored is a guess. Restore one to a staging copy now and then.

Monitoring

• 21. Malware and file-change scans run on a schedule. Scanners such as Wordfence compare your WordPress, theme and plugin files with the official copies and report changes.
• 22. Uptime is checked from outside. An outside monitor tells you when the site stops responding, often the first sign of trouble.
• 23. Alerts reach someone who reads them. The Administration Email Address under Settings > General receives WordPress's recovery and error notices, so make sure it is not a former developer's inbox.

WooCommerce and payments

• 24. Card details never touch your server. Use a gateway such as WooPayments, Stripe or PayPal that collects card details in its own secure fields. WooCommerce never stores card numbers, but PCI compliance (the card industry's security rules) is still the store owner's responsibility.
• 25. Store staff have only the access they need. A Shop Manager can see customer details, issue refunds and change every WooCommerce setting, so give the role sparingly, with two-factor login.

How does two-factor authentication work in WordPress?

Two-factor authentication (2FA) asks for a second proof after your password, usually a code from your phone or a passkey, so a stolen password alone cannot get in. WordPress core does not include it: you add a plugin, and each user sets it up in their own profile.

Which two-factor method should you choose?

• Authenticator app (recommended). Scan a QR code once with an app such as Google Authenticator, Authy or 1Password, and it shows a new code every 30 seconds, even offline.
• Email codes. Easy to set up, but anyone who gets into your inbox receives both the code and your password reset link.
• Text messages. Weaker still: WordPress's own documentation notes that SMS is not a secure channel.
• Passkeys. You sign in with a fingerprint, face or device PIN. A passkey only works on the site it was made for, so a fake login page cannot capture it. Register at least two per administrator, such as a phone and a laptop.

Save your backup codes in your password manager. They get you back in if you lose your phone.

Which plugin adds two-factor login?

• Two-Factor, free and maintained by WordPress contributors: authenticator apps, email codes and backup codes, with passkeys through an add-on plugin. It cannot require 2FA, so check that every administrator has turned it on.
• Wordfence, free: authenticator apps, passkeys, and a block on administrator logins that use passwords exposed in data breaches.
• Kadence Security (formerly iThemes Security), free: authenticator apps, email codes and backup codes, and you can require users to set up 2FA.

Which security tips are not worth much?

These popular tips add little real protection. Do them after the checklist, not instead of it.

• Hiding the WordPress version. Removing the version tag hides little, because WordPress also puts its version number in the addresses of its own scripts and styles, and a site on the current release has nothing useful to hide.
• Renaming the wp_ table prefix. WordPress's hardening guide says it can block some SQL injection attacks that assume the default. It does not fix the flaw, though, and on an existing site the prefix also appears inside the database, so changing it is a risky edit. Set it at installation, or leave it.
• Changing the login address. It cuts down bot noise, but WordPress's guide says it should not be your only defense.

Can someone run these checks for you?

Yes. Every WP Resolve care plan covers much of this list: weekly core, theme and plugin updates with visual checks, daily off-site backups kept 30 days, malware scanning, uptime monitoring, basic hardening (login protection and firewall rules) and a monthly report. Plans are month to month with no minimum term, starting with Essential Care at $79 a month. Business Care ($149 a month) tests updates on a staging copy first and includes malware cleanup, and Commerce Care ($199 a month) adds checkout and order-flow monitoring for WooCommerce stores.

Not sure where your site stands? Ask for a free site health check covering your updates, backups, security and speed, or text (916) 209-0917.

Frequently asked questions