WordPress security checklist for small business owners

Your WordPress site is often the first thing a customer sees, and it is also one of the first things an attacker looks at. The good news is that most of the protection comes from a short list of habits, not from expensive tools.

This checklist is written for the owner, not the developer. You do not need to do each step yourself. You need to know what to check and what to ask the person who looks after your site.

1. Keep WordPress itself up to date

The official WordPress hardening guide is blunt: you should always keep up to date with the latest version of WordPress. Older versions lack security fixes, and flaws that have been fixed are publicly described, which makes old sites easy targets.

Check: log in, open the Dashboard and look at Updates. Ask your developer: who applies updates, how often, and what happens if an update breaks the site.

2. Treat plugins and themes as the biggest risk

Plugins and themes are code written by other people, running inside your site. The hardening guide says to download them only from WordPress.org or from established companies, to keep them updated, and to remove any you do not use.

Check: list your plugins. Delete the ones you do not use, rather than just switching them off. Ask: who chose each plugin, and is it still maintained?

3. Make every login strong, and turn on two-step verification

The guide advises passwords with no dictionary words or personal details, a decent length and a mix of letters and numbers, and it recommends two-step authentication for extra protection. Two-step authentication means a login also needs a code from an app or phone, so a stolen password alone is not enough.

Everyone who can log in should have their own account. If you need help storing logins safely, read our guide on how to share passwords with staff safely.

Check: how many people can log in as administrator? Does anyone who has left still have an account?

4. Do not use “admin” as the administrator username

The hardening guide says to avoid easily guessed names such as admin or webmaster for administrator accounts, because those are attacked first.

Check: look at Users. If the main administrator is called admin, ask your developer to move to a different name.

5. Keep backups, and keep them somewhere else

The guide recommends regular backups of both the database (where your pages and orders live) and the files, kept in a trusted place, and it suggests weekly snapshots of the whole installation so you can recover if a compromise goes unnoticed for a while.

A backup stored only on the same server as the site can be lost with the site. Ask: where do the backups go, how often, and when was a restore last tested?

6. Use HTTPS, especially for the admin area

The guide recommends an encrypted HTTPS connection for administration, so that what you type on the login page cannot be read on the way. You can see it as the padlock in the browser. The free SSL checker shows whether your certificate is valid and when it expires.

7. Ask about file permissions and the settings file

Two technical items from the guide are worth knowing exist, so you can ask about them. The first is file permissions: the core WordPress folders should be writable only by the account that owns them. The second is the settings file, wp-config.php, which holds the keys to your database. The guide suggests protecting it and switching off file editing from inside the dashboard, so an attacker who gets into an admin account cannot rewrite your site code from there.

You do not need to change these yourself. Ask: “Are file permissions and wp-config.php locked down, and is the dashboard file editor turned off?”

How often to run this checklist

Do the ten-minute version once a month, and again whenever someone joins or leaves your team, or you add a new plugin. Put it in the calendar, because security jobs that nobody owns tend not to happen. Write down the date you did it and who did it, so that next month you can see at a glance what changed.

If something already looks wrong, such as strange pages, redirects to other sites or a warning in search results, do not wait for the next monthly check. Follow our guide on what to do if your WordPress site is hacked, and keep a note of what you see, because it helps whoever is cleaning it up.

A ten-minute version

1. Update WordPress, plugins and themes.
2. Delete plugins and themes you do not use.
3. Remove old user accounts.
4. Make sure the administrator is not called admin.
5. Turn on two-step verification for administrators.
6. Find out where backups go and when they were last tested.
7. Check the padlock shows on every page, including the login page.

Want a second pair of eyes on your site?

A checklist tells you what to look at. It cannot tell you what is already wrong. Run the free website security checker for a quick outside view of your site, then see our website security service if you would like us to review and fix what it finds.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

Sources and further reading

• Hardening WordPress, WordPress developer documentation. Source for every recommendation above: keeping WordPress updated, plugins and themes, passwords and two-step authentication, the administrator username, backups, HTTPS for administration, file permissions and wp-config.php.