New format
WordPress site security: a practical checklist
WordPress is popular — and therefore often targeted: holes in core, plugins, and themes, weak passwords, an open wp-admin. A breach hits SEO: spam, redirects, malware in the SERP, lost trust.
Below: a practical WP hardening checklist. General threats (injections, XSS, brute force) live in the site security article; here — CMS specifics. Defense and recovery only — not breach scenarios.
Why WordPress is attacked so often
WP’s share of the web is huge: scanners hunt known CVEs in core and popular plugins. Vulnerability news appears regularly — watch updates and don’t leave the site on a version “because it works.”
A typical entry point isn’t hacker magic — it’s a weak password, login admin, an outdated plugin, an infected theme from a pirate archive, or FTP with one password for everything.
Hardening priorities:
- core, theme, and plugin updates
- strong unique passwords + 2FA
- minimum extensions
- backups and HTTPS
- restricted admin access
Access: login, password, 2FA, IP
Don’t use predictable logins like admin. Strong password: length, case, digits, symbols, uniqueness (password manager). Turn on two-factor authentication for administrators.
Change or protect the login URL (don’t rely on a “secret” address alone — it only adds friction). With a static office IP you can lock wp-admin at the server layer; with a dynamic IP that lockout easily locks you out — plan exceptions.
Access minimum:
- no shared password for email, hosting, and WP
- 2FA on admins
- roles by least privilege
- close unnecessary author or login exposure
Updates, plugins, and themes
Apply core and extension updates after a backup. Delete unused plugins and themes entirely. Keep trusted, maintained products; “do-everything” suites often drag extra code.
Themes — from the official repo or paid authors with updates. Pirated “premium free” packs are a common backdoor source. Before install, check the last update date and reviews.
Extension hygiene:
- inventory once a quarter
- remove idle plugins
- don’t install everything “just in case”
- security and backup — from trusted sources
Backups, HTTPS, file permissions
File and DB backups — automatic (hosting or plugin) and periodically manual to independent storage. Verify the backup actually restores.
SSL/TLS is mandatory. Disable theme and plugin file editing from the admin on prod (`DISALLOW_FILE_EDIT`) so a stolen session can’t easily drop a shell. File and directory permissions — per host guidance, not 777 “to make it work.”
After an incident:
- change all passwords and salts or keys
- roll back to a clean backup
- update everything
- check Webmaster / Search Console for malware
- rotate API and mail secrets
What not to treat as a silver bullet
Changing the table prefix, hiding the WP version, and a “secret” login URL alone don’t fix an outdated plugin. Updates, monitoring, a hosting or CDN WAF, and access discipline help.
Hardening is continuous. For SEO you need a clean site without spam pages and browser warnings. After stabilization, return to content and tech: rankings build over months — not right after changing the password.
Final checklist:
- updates are a ritual
- passwords + 2FA
- few plugins, clean themes
- backups verified
- HTTPS and file-edit disabled on prod
- general hygiene from the site security article
FAQ
Is WordPress insecure by definition?
No. Risk grows from popularity and forgotten plugins. Timely updates and access hygiene cut the threat a lot.
Is one security plugin enough?
As a layer — yes. It doesn’t replace updates, strong passwords, backups, and a minimum of extensions.
Should I change the wp_ table prefix?
Weak obscurity. Updates, DB privileges, and backups matter more. Changing the prefix on a live site risks breakage — only with a clear plan and a copy.
Is HTTPS mandatory?
Yes for admin, forms, and trust. A certificate protects the channel; it doesn’t replace CMS patches.
How many plugins is normal?
As many as you truly need. Each extra one is attack surface and conflicts. Delete unused ones — don’t only deactivate.
Are free themes dangerous?
Not all. Themes and plugins from shady “nulled” archives with backdoors are. Take them from the official catalog or trusted authors.
What should I do if I suspect a breach?
Change all passwords and keys, restore from a clean backup, update core, plugins, and themes, check webmaster panels for malware, bring in a specialist if needed.
Does hardening WordPress improve rankings?
Not directly. But a breach drops traffic and trust. Stability first; SEO expectations over months after that — prep is not page-one rankings, and share of the core usually builds over two to six months after work starts.
WP still runs on outdated plugins — and “secret login URL” is the whole security plan?
We’ll harden updates, access, backups, and HTTPS — defense hygiene, not attack playbooks.
Discuss the task
