The WordPress Security Checklist Every Small Blog Owner Needs

I have cleaned up three hacked WordPress sites for people this year alone, and every single one traced back to something on this list that had been ignored for months, sometimes years.

Most WordPress compromises come from skipped basics, not sophisticated attacks.

The checklist

1. Core, theme, and plugin updates
2. Login hardening
3. Removing what you are not using
4. File permissions and the wp-config.php file
5. Backups that actually get tested
6. A security plugin, used correctly

Most WordPress attacks are not aimed at you specifically. They are automated bots scanning millions of sites for a small set of known, unpatched vulnerabilities, and moving on the moment they find one that does not apply. That means the bar for staying safe is often lower than people assume. You do not need to outsmart a dedicated attacker, you just need to not be the easy target sitting next to nine hundred other easy targets.

1Core, theme, and plugin updates

This is the single biggest factor by a wide margin. The vast majority of WordPress compromises exploit a vulnerability that was already patched, sometimes months earlier, in a version the site owner just never installed. Enable automatic updates for WordPress core through Settings, then Updates, and check your plugin list at least monthly. If a plugin has not been updated by its developer in over a year and has no recent activity, that is a real risk sitting on your site even if nothing has gone wrong yet.

The WPScan vulnerability database tracks known WordPress, plugin, and theme vulnerabilities and is worth a quick search if you are deciding whether to keep an older plugin installed.

2Login hardening

The default /wp-admin login page is the most brute-forced URL on the entire web, simply because so many sites use it unchanged. A few changes go a long way:

• Use a strong, unique password for every admin account, not shared with anything else
• Enable two-factor authentication through a plugin like WP 2FA or your host's built-in option
• Rename the default "admin" username if you are still using it, since it is the first guess in every automated attack
• Limit login attempts so repeated failed guesses get locked out rather than allowed to continue indefinitely

3Removing what you are not using

Deactivated plugins and themes still sitting in your files are not neutral. Their code is still present and can still be exploited even while inactive, and outdated ones you forgot about do not get flagged for updates the way active ones do. Delete anything you are not actively using rather than just deactivating it. The same goes for old backup files, test pages, and installer scripts left over from your site setup, all of which are common things attackers scan for directly.

4File permissions and the wp-config.php file

Your wp-config.php file holds your database credentials and security keys, making it one of the most sensitive files on your entire server. Most hosts set reasonable defaults, but it is worth confirming that files are set to 644 and folders to 755, not more permissive settings like 777 that some old tutorials still recommend out of convenience. If your host offers a file integrity monitor, enabling it will flag unexpected changes to core files, which is often the first sign of a compromise.

5Backups that actually get tested

A backup you have never restored from is a backup you are only assuming works. Set up automated backups through your host or a plugin like UpdraftPlus, store a copy somewhere other than the same server the site lives on, and actually test a restore at least once so you know the process before you are relying on it in a panic. Every hacked site cleanup I have done was faster and calmer for the owners who had a real backup ready, and considerably worse for the ones who did not.

6A security plugin, used correctly

Plugins like Wordfence or Sucuri add firewall rules, malware scanning, and login monitoring on top of everything above. They are genuinely useful, but they are a layer, not a replacement for the basics. A security plugin on a site running six-month-old core software and a dozen outdated plugins is closing one door while several others stay wide open.

Being straight about this: none of this is exciting to actually do. Updating plugins monthly is boring. Testing a backup restore is boring. That is exactly why it gets skipped, and exactly why it is also the thing that separates the sites that quietly keep running from the ones I get called about after the fact.

None of these six steps require deep technical skill, and together they cover the overwhelming majority of how small WordPress sites actually get compromised. Set aside twenty minutes this week to work through the list once, then build the recurring parts, updates and backup checks, into a monthly habit rather than a one-time fix.