WordPress security is a maintenance practice, not a one-time plugin install. This checklist helps site owners reduce avoidable risk without piling on overlapping tools or making risky production changes.
Start with current updates
Keep WordPress core, themes, and plugins on supported releases. Review the update screen regularly, read material vendor notes for important changes, and verify the site after every meaningful update. For the current core release path, use our WordPress 7.0.2 security update checklist.
1. Keep the running stack current
- Remove inactive plugins and themes you no longer need.
- Use maintained software from trusted publishers.
- Apply security releases promptly, then test the homepage, contact forms, checkout, account, and editor workflows.
- Do not edit WordPress core files or a parent theme directly.
2. Protect privileged access
Give every administrator a named account, use a password manager, and enable multi-factor authentication where the hosting or security stack supports it. Review administrator, editor, and shop-manager roles after staff or vendor changes. Keep recovery email addresses current and remove accounts that no longer need access.
3. Use a small, purposeful plugin stack
Each plugin should solve a clear problem and have an owner who understands its update and recovery path. Avoid duplicate cache, security, redirect, image, or page-builder plugins. A lean stack is easier to patch, troubleshoot, and document.
4. Make recovery part of security
Maintain a recovery plan that matches the value and change rate of the site. Know where the current restore point lives, who can restore it, and how you will validate the restored site before an incident. A backup that has never been checked is not a recovery plan.
5. Use layered protection
Keep HTTPS working, restrict administrative access appropriately, use the security features provided by your host or CDN, and monitor for unusual administrator changes, plugin installs, redirects, and email behavior. A WAF can reduce exposure while you patch, but it does not replace updates.
6. Follow a simple maintenance cadence
- Weekly: review updates, failed jobs, and new administrator accounts.
- Monthly: remove unused software and confirm essential forms, email, and conversion paths.
- After major changes: test public pages, authenticated workflows, cache behavior, and monitoring alerts.
Build a safer support routine
For practical help with updates, performance, recovery planning, and troubleshooting, visit our WordPress support hub. If performance is part of the security problem, pair this checklist with our WordPress performance guide.
