Quick answer
- Go through this checklist every few months: updates, logins, users, plugins, backups, SSL, firewall and monitoring.
- The fastest wins: update everything, turn on two-factor authentication and remove unused plugins and users.
- Make sure backups run automatically and are stored off-site, and test a restore.
- For a deeper look, follow our full WordPress security guide.
Use this 10-step WordPress security checklist to quickly check your site and fix the most common weak spots.
The checklist
- 1. Updates: WordPress core, plugins and themes are up to date.
- 2. PHP version: your host runs a supported PHP version.
- 3. Passwords: every admin uses a strong, unique password.
- 4. Two-factor authentication: on for all admin accounts.
- 5. Login protection: login attempts are limited.
- 6. Users: no old accounts; everyone has the lowest role they need.
- 7. Plugins and themes: unused ones deleted; no nulled software.
- 8. HTTPS: SSL active and HTTP redirects to HTTPS.
- 9. Firewall and scans: a firewall is on and malware scans run regularly.
- 10. Backups: automatic, off-site and tested.
Useful free tools
| Need | Plugin (WordPress.org, Nov 2026) |
|---|---|
| Firewall and malware scan | Wordfence |
| Two-factor authentication | WP 2FA |
| Login protection | Limit Login Attempts Reloaded |
| SSL and hardening | Really Simple Security |
| Backups | UpdraftPlus |
Go deeper
FAQs
Every few months, and after big changes.
Keeping everything updated.
No. Many hosts include firewalls and backups; add only what’s missing.
Yes. It blocks most password-based attacks.
Restore one to a staging site.
A currently supported version your plugins work with.
