WordPress security checklist: 15 things to check today

Most WordPress security is not exotic. It is a short list of plain jobs done regularly, and the list below covers the large majority of the ways WordPress sites are actually compromised: out-of-date plugins, weak or stolen logins, loose file permissions, and infections nobody noticed.

Each item says what to check and how. Commands assume WP-CLI over SSH; every one also has a wp-admin or file-manager route. Set aside 30 to 45 minutes for the first pass. Later passes take about ten, because you are only confirming that nothing has changed.

Updates

1. WordPress core is on the latest version. Check Dashboard, then Updates, or run wp core version and wp core check-update. Security releases of core are patched quickly, and attackers start scanning for unpatched sites within days.
2. Every plugin is updated. Run wp plugin list --update=available. Out-of-date plugins are the most common way WordPress sites are broken into, so if you only do one item on this list, do this one. Read the changelog first on a site that earns money, and keep a backup before updating.
3. Every theme is updated, including the parent theme if you use a child theme. wp theme list --update=available shows what is behind.
4. Unused plugins and themes are deleted, not just deactivated. Inactive code can still be requested directly by URL, so a vulnerable plugin you switched off is still a way in. Keep one default theme as a fallback and remove the rest.

Credentials and access

5. Every admin account has a unique, strong password. Use a password manager and never reuse a password from another service. Reused passwords from leaked databases are tried against WordPress logins around the clock; the brute-force guide explains what that traffic looks like.
6. The user list has no accounts you do not recognize. Run wp user list --role=administrator and check each name and email. A new administrator you did not create is one of the clearest signs of a compromise.
7. Two-factor login is on for every administrator. It stops a stolen password from being enough. Editors and shop managers are worth covering too if they can publish or change orders.
8. Hosting, database and SSH credentials are separate from the WordPress login. If one password opens everything, one leak loses everything. For server access, SSH keys are safer than passwords; see SSH keys vs passwords for WordPress.

Files and configuration

9. File permissions follow the standard scheme: 755 for directories and 644 for files, tighter for wp-config.php. List anything looser with find . -type f -perm /o+w. The file permissions guide has the full scheme and the commands to fix it.
10. wp-config.php is locked down. It holds your database password and secret keys, so it should not be readable by other users on the server (600 or 640 where your host allows), and WordPress can load it from one folder above the web root. See how to secure wp-config.php.
11. No unfamiliar PHP files exist in wp-content/uploads. This folder is for images and documents, so PHP files there are almost always malicious. Run find wp-content/uploads -name "*.php". An empty result is what you want.
12. Core files match the official checksums. Run wp core verify-checksums. Any file reported as modified or unexpected deserves a look, because attackers often edit core files to hide a backdoor. The core file integrity guide explains how to read the result.

Backups and monitoring

13. A recent backup exists and has been restored at least once. A backup that has never been tested is a guess. Restore one to a staging copy and confirm the site loads. Keep copies away from the server, and remember a backup can contain an infection; see managed hosting security for why a backup is not a scan.
14. Google Search Console is connected and shows no security issues. Google often spots a hack, such as spam pages or redirects, before the owner does, and the Security issues report is where it tells you.
15. Something checks file integrity and malware patterns on a schedule. That can be you, a plugin, or an automated service. Weekly is a sensible rhythm for most sites, and how often to scan covers when to go faster.

If something on the list fails

Fix the cheap items first: updates, deleting unused code, and changing passwords. Then work through permissions and configuration. If you find a file you cannot explain, an administrator you did not create, or PHP in the uploads folder, treat the site as possibly compromised and follow the five-minute hack check before changing anything else, so you do not destroy evidence or leave the attacker's way back in.