WordPress Security Checklist for Business Owners (2026)

What Are the Most Critical WordPress Security Steps?

These five items address the most common attack vectors. If your site lacks any of them, you’re exposed right now.

Keep WordPress Core, Themes and Plugins Updated

Why this matters: Outdated software is the number one cause of hacked WordPress sites. When developers discover a security flaw, they release a patch. If you don’t install it, attackers use that known flaw to break in. Think of it like a lock manufacturer recalling a defective lock: if you don’t swap it out, burglars know exactly how to pick it.

• Turn on automatic updates for WordPress core (Settings > General in most hosts)
• Update themes and plugins at least once per week
• Check for updates manually if auto-updates are disabled

Use Strong Passwords and Two-Factor Authentication (2FA)

Why this matters: “Password123” takes a bot less than one second to guess. Attackers run automated tools that try thousands of common passwords against your login page every day. A strong password (16+ characters, random) stops brute force attacks. Two-factor authentication adds a second layer: even if someone steals your password, they still can’t log in without your phone.

• Use a password manager to generate and store unique passwords
• Install a 2FA plugin (WP 2FA or Wordfence Login Security are solid choices)
• Require 2FA for all admin and editor accounts

Install an SSL Certificate (HTTPS)

Why this matters: SSL encrypts the data flowing between your visitors’ browsers and your website. Without it, login credentials, contact form submissions and payment details travel across the internet in plain text. Google also uses HTTPS as a ranking factor, so an unsecured site loses search visibility.

• Most hosting providers offer free SSL through Let’s Encrypt
• Verify your site loads at https:// (not http://)
• Set up a redirect so all HTTP traffic goes to HTTPS automatically

Remove Unused Themes and Plugins

Why this matters: Every theme and plugin on your site is a potential entry point for attackers. Deactivating a plugin does not remove the risk; the code still sits on your server and can be exploited. If you’re not using it, delete it.

• Go to Plugins > Installed Plugins and delete anything you don’t actively use
• Keep only one inactive theme (the latest default theme) as a fallback
• Audit your plugin list quarterly

Block xmlrpc.php

Why this matters: xmlrpc.php is a legacy file that lets external apps communicate with WordPress. Most modern sites don’t need it. Attackers abuse it to launch brute force login attacks and DDoS amplification attacks; a single xmlrpc request can test hundreds of passwords at once. Blocking it shuts down a major attack channel.

• Ask your host to block access to xmlrpc.php at the server level
• Alternatively, a security plugin like Wordfence can disable it
• Test your site’s forms and mobile app connections after blocking (most will work fine)

Important Security Measures (Do These This Week)

Once the critical items are handled, these measures significantly reduce your remaining risk.

Set Up Automated Backups

Why this matters: Backups are your insurance policy. If your site gets hacked, a clean backup lets you restore everything in minutes instead of rebuilding from scratch. Without backups, a hack could mean losing months of content, customer data and SEO authority.

• Use a backup plugin (UpdraftPlus or BlogVault) or your host’s backup tool
• Schedule daily backups of both files and the database
• Store backups off-site (Google Drive, Dropbox or Amazon S3) so they survive a server compromise

Limit Login Attempts

Why this matters: By default, WordPress allows unlimited login attempts. Attackers exploit this by running automated scripts that try thousands of username/password combinations. Limiting attempts to 3-5 per IP address before a temporary lockout stops brute force attacks cold.

• Install Limit Login Attempts Reloaded or use Wordfence’s built-in feature
• Set a lockout duration of at least 30 minutes after 5 failed attempts
• Enable email notifications for repeated lockouts (this flags active attacks)

Change the Default Admin Username

Why this matters: If your admin account is still called “admin,” attackers already have half your login credentials. They only need to guess the password. Creating a new administrator account with a unique username and deleting the default “admin” account eliminates the easiest target on your site.

• Create a new user with an Administrator role and a non-obvious username
• Log in with the new account and delete the old “admin” user
• Assign all existing content to your new admin account when prompted

Disable File Editing in WordPress Admin

Why this matters: WordPress includes a built-in code editor (Appearance > Theme Editor and Plugins > Plugin Editor) that lets anyone with admin access modify your site’s files directly. If an attacker gains admin access, this editor lets them inject malicious code instantly. Disabling it forces all code changes to go through FTP or your hosting file manager, adding a critical barrier.

• Add define('DISALLOW_FILE_EDIT', true); to your wp-config.php file
• Your developer or host can do this in under a minute

Review User Permissions

Why this matters: Not every user needs admin access. The principle of least privilege means each person gets only the access they need to do their job. A content writer needs Editor access, not Administrator. Fewer admin accounts means fewer high-value targets for attackers.

• Go to Users > All Users and review every account
• Downgrade roles where possible (Contributor, Author or Editor instead of Administrator)
• Remove accounts for former employees, contractors or vendors immediately

Recommended Hardening (Monthly Review)

These measures strengthen your site’s defenses beyond the basics. Review them monthly or after any significant site changes.

Security Headers

What this means in plain language: Security headers are instructions your server sends to visitors’ browsers, telling them how to handle your site’s content safely. They prevent attacks like clickjacking (where someone loads your site inside a hidden frame to trick users) and cross-site scripting (where attackers inject malicious code into your pages). Your host or developer can add these in a few minutes.

REST API Restrictions

What this means in plain language: WordPress exposes a data feed (the REST API) that anyone on the internet can query. By default, it reveals your usernames and site structure to attackers. Restricting it blocks unauthorized access while keeping your site’s features working. Read our full guide on how to secure the WordPress REST API for step-by-step instructions.

Database Prefix Change

What this means in plain language: WordPress stores all your site data in a database. By default, every table name starts with wp_. Attackers know this and write automated attacks targeting those exact table names. Changing the prefix to something random (like qm7x_) makes those automated scripts fail. This is best done during initial setup; changing it on a live site requires careful database work.

File Permissions Audit

What this means in plain language: File permissions control who can read, write and execute files on your server. Incorrect permissions let attackers modify your site’s code or upload malicious files. The correct settings are 644 for files and 755 for directories. Your hosting provider can verify and fix these for you.

Monitor for Malware

What this means in plain language: Malware is malicious code that attackers inject into your site. It can redirect visitors to scam pages, steal credit card numbers or send spam from your domain. Regular scanning catches infections early before they damage your reputation or get your site blacklisted by Google. Wordfence, Sucuri or MalCare all provide automated scanning.

When to DIY vs. Hire a Professional

Some security tasks are straightforward; others carry real risk of breaking your site. Here’s an honest breakdown.

What Professional WordPress Security Costs

• One-time security audit: $500 to $2,000 depending on site complexity. Covers vulnerability assessment, configuration review and a prioritized fix list.
• Ongoing security monitoring: $100 to $300/month. Includes malware scanning, uptime monitoring, firewall management and incident response.
• Full security hardening: $2,000 to $5,000. Comprehensive implementation of all items on this checklist plus custom server-level protections and ongoing support.

For most small business sites, a one-time audit combined with a monitoring plan provides the best return on investment. Learn more about our WordPress development and security services.

What Do Business Owners Ask About WordPress Security?

Get a Free WordPress Security Audit

Not sure where your site stands? We offer a complimentary WordPress security assessment for Canadian businesses. We’ll review your current setup, identify vulnerabilities and provide a clear action plan with priorities.

• Call: 604-901-7668
• Email: info@quakemedia.ca

Or fill out the form below and we’ll get back to you within one business day.

Already know what you need? Explore our WordPress REST API security guide or browse our full web development services.