WordPress security is a repeatable maintenance practice, not a plugin switch. This checklist helps site owners and administrators protect access, keep the software baseline current, monitor for unexpected changes, and prepare a recovery path before a real incident forces rushed decisions.
Start with the current stable WordPress release, not a development build. When a core security release applies to your site, use the separate WordPress 7.0.2 security update checklist; use beta builds only on a controlled test copy. The broader set of setup and troubleshooting guides lives in WordPress Support.
1. Protect administrator access
- Give every administrator a named account. Remove former staff, contractors, and test accounts rather than sharing a single login.
- Use unique passwords stored in a password manager and enable two-factor authentication wherever the chosen access tool supports it.
- Keep administrator access to the smallest practical group. Review roles after a site launch, a staff change, or a new agency engagement.
- Check the WordPress users list for unfamiliar administrators and confirm that support, hosting, and ecommerce accounts have only the access they need.
2. Maintain a safe update rhythm
Keep WordPress core, plugins, themes, and server software current according to their supported update paths. Before a larger change, confirm what is active, review vendor compatibility notes, and test the workflows that matter on staging. Our WordPress staging test guide is a practical companion for forms, editing, search, ecommerce, and mobile checks.
After an update, verify the front page, a representative page or post, the login flow, forms, scheduled publishing, and checkout where relevant. Treat unexpected errors or changed permissions as a reason to pause the next change and investigate, not as something to hide with a cache clear.
3. Remove code you no longer need
Every inactive plugin or theme is another component to review. Remove unused items only after confirming that they are not required by a child theme, integration, staging workflow, or rollback plan. Use the unused plugins and themes cleanup checklist to make that review deliberate.
Favor maintained software with a clear update history and support path. Keep a short inventory of critical plugins, licenses, and the business workflow each one supports, especially for forms, payments, membership, backup, caching, and security tooling.
4. Monitor for malware and unexpected changes
Use a maintained security or host-level malware scanner as one signal, then review any alert in context. A clean scan is useful evidence, but it is not a guarantee that every problem is absent. Watch for unfamiliar administrator accounts, unexpected redirects, new plugins or themes, altered site content, unusual outbound email, and changes to files that should be stable.
For cPanel and WHM environments, the ImunifyAV malware scan checklist explains a safe review workflow. For WordPress-side alerts, see how to check WordPress security plugin alerts. Preserve the facts of an alert, limit unnecessary changes while it is assessed, and involve the host or a qualified incident-response provider when customer data, payment flows, or multiple sites may be affected.
5. Test recovery before an emergency
A backup only becomes a recovery plan when the restore path has been tested. Know what content, uploads, settings, and ecommerce records are covered; define who can approve a restore; and practice the workflow on a separate test environment. Use the WordPress backup and restore test guide to make that validation structured.
Do not treat routine publishing or a small configuration edit as a reason to create broad account exports. Keep the established backup policy intact, and reserve recovery actions for a documented operational need.
6. Keep the hosting and delivery layer in view
- Use HTTPS and resolve mixed-content issues rather than accepting browser warnings. The HTTPS without redirect loops guide can help plan that work.
- Review hosting-panel accounts, FTP or SFTP users, database users, and email forwarding rules as part of normal access hygiene.
- Watch account capacity. Disk or inode pressure can block updates, backups, uploads, and logs; Help4 Disk Usage helps hosting teams triage capacity reports without deleting customer files.
- Use a CDN or WAF as an additional protective layer, not a replacement for patching WordPress and controlling access.
7. Keep a short incident checklist
If you suspect compromise, first limit unnecessary administrator changes, capture the basic timeline, check recent users and changes, and contact the hosting or security provider through a trusted channel. Avoid copying unverified cleanup scripts from public posts or making broad deletions under pressure. The first goal is to understand scope, preserve a defensible recovery path, and protect visitors while the issue is assessed.
