WordPress Security Checklist (2026): 20 Steps to Protect Your Site From Hackers

Most hacked WordPress sites are not targeted personally. Automated bots scan for outdated software, weak passwords and abandoned plugins, and they break in where something is easy. This checklist is the order I follow on my own servers and when I clean up a hacked site.

From my own work: I once cleaned a business site that had been compromised: rogue administrator accounts, a plugin quietly publishing spam posts and changed security keys needed after cleanup. Almost every item below would have prevented it. And on 21 October 2026, when PHP released emergency fixes for two critical vulnerabilities, I patched my own server the same day; one package conflict briefly broke my sites until I fixed it, which is why backups come first.

Layer 1: Server and PHP

1. Run a supported PHP version. Check php.net/supported-versions. Versions that no longer get security fixes (7.x, 8.0, 8.1) should not serve websites.
2. Apply PHP security releases quickly. PHP flaws are not fixed by WordPress updates; the server must be updated and PHP restarted. Always take a backup first.
3. Use HTTPS everywhere with a valid certificate and redirect HTTP to HTTPS.
4. Remove unused PHP versions and software from the server so there is less to attack.
5. Keep the firewall tight: open only the ports you need, and restrict the hosting panel to your own IP where possible.

Layer 2: WordPress, themes and plugins

6. Update core, themes and plugins regularly. Enable auto-updates for minor core releases and trusted plugins.
7. Delete (not just deactivate) anything unused. Deactivated plugins can still be exploited.
8. Install only from trusted sources: the WordPress.org directory or the vendor. Never use “nulled” premium plugins; they often carry malware.
9. Choose actively maintained plugins with recent updates and a good support history.
10. Disable the file editor by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php.

Layer 3: Logins and access

11. Use unique, long passwords from a password manager, for WordPress, hosting, database and email.
12. Turn on two-factor authentication for every administrator.
13. Give each person their own account with the lowest role that works (Editor or Author instead of Administrator).
14. Audit users regularly. Unknown administrators are a classic sign of compromise.
15. Limit login attempts and block brute-force traffic with a firewall plugin or your server’s fail2ban.

Layer 4: Backups and monitoring

16. Automate backups daily for active sites, stored off the server (cloud storage).
17. Test a restore at least once. A backup you have never restored is a hope, not a plan.
18. Run a malware and file-integrity scan (one security plugin is enough; two overlapping ones slow the site and conflict).
19. Watch Google Search Console for Security Issues and unexpected pages in the index.
20. Enable uptime monitoring so you hear about downtime before customers do.

If your site is hacked: a safe order

1. Put the site in maintenance mode or restrict access; do not just delete files.
2. Take a full backup of the infected state for analysis.
3. Change all passwords (WordPress, hosting, database, FTP/SSH) and regenerate the WordPress security keys.
4. Remove unknown admin users, unknown plugins and modified core files; reinstall core, themes and plugins from clean sources.
5. Find and fix the entry point (usually an outdated plugin) or it will happen again.
6. Request a review in Search Console if Google flagged the site.

Need help with this on your own site or business?

I build and secure WordPress sites, web apps and AI automations end to end, in Bangla and English. The process is a free discovery call, a written scope with a fixed quote, a focused first version, then testing, deployment and monitoring.

See the portfolio and the AI agent services, or tell me what you need.

FAQ

Is a security plugin enough?

No. A plugin helps, but updates, PHP version, strong access control and backups matter more.

How often should I update?

Check weekly; apply security updates immediately and test on a staging copy for major changes.

Why do I need to update PHP if WordPress is current?

PHP is the engine WordPress runs on. A flaw in PHP itself is only fixed by updating PHP on the server.

Sources

• WordPress.org: Hardening WordPress
• PHP: Supported Versions
• WordPress.org: Two-factor and password guidance
• Google Search Central: Hacked sites