Free resource
WordPress Security Checklist
25+ points to check to protect your WordPress website from hackers. A free PDF you can print and use.
Complete overview – 25+ security points organised in logical categories
Prioritised order – Start with what matters most - priorities are marked
Tick boxes – Print it out and tick things off as you check them
Links to resources – Direct links to recommended plugins and guides
What's included
Security basics
- Strong admin password (at least 12 characters)
- Unique username (not 'admin')
- Two-factor authentication
- + 2 more...
Updates
- WordPress core is up to date
- All plugins are up to date
- Theme is up to date
- + 2 more...
Backup & recovery
- Daily automatic backup
- Backup stored off-site
- Backup restore tested
- + 2 more...
+ many more categories in the full checklist
Everything in the checklist
A complete overview of what to check to secure your WordPress site
Security basics
- Strong admin password (at least 12 characters)
- Unique username (not 'admin')
- Two-factor authentication
- Limit login attempts
- Hide the WordPress version
Updates
- WordPress core is up to date
- All plugins are up to date
- Theme is up to date
- PHP version is current (8.0+)
- Automatic security updates
Backup & recovery
- Daily automatic backup
- Backup stored off-site
- Backup restore tested
- Backup of database AND files
- Retention policy (30+ days)
Server & hosting
- SSL/HTTPS enabled
- Secure file permissions
- Disable XML-RPC (if not in use)
- Secure wp-config.php
- HTTP security headers
Why WordPress security matters
- 30,000+
WordPress sites are hacked every day (source: Sucuri)
- 98%
of hacks are caused by outdated plugins/WordPress
- 15 min
is all you need for basic hardening
Most hacks can be prevented with simple security measures. This checklist walks you through all of them.
Download the checklist for free
Enter your email and get the checklist sent straight to your inbox
100% free
No spam
Need help securing your site?
I offer professional security reviews and set-up of WordPress sites. Get peace of mind with an expert.