Use this WordPress security checklist to cover updates, tested backups, strong logins and two-factor authentication, user roles, trusted plugins, wp-config hardening, firewalls and recovery after a hack.
A WordPress security checklist comes down to a few habits: keep everything updated, protect logins, give people only the access they need, install code only from trusted sources, keep backups you have tested, and know what to do when something goes wrong. The steps below follow the order that matters most, and the technical settings come from WordPress's own hardening guidance, as of October 2026.
In short
Attackers get in through a few doors: a password that was guessed or stolen, outdated or vulnerable software, code from an untrusted source, and weak server settings. The checklist closes each door, then adds ways to notice and recover if one is open anyway. The two main official sources are the hardening guide and the FAQ My site was hacked.
WordPress's guidance is to always keep up to date. Since WordPress 5.5 you can switch on automatic updates plugin by plugin and theme by theme, and WordPress checks for them twice a day by default. They depend on WP-Cron, so Tools > Site Health shows an error if they cannot run. On a shop, take a backup first and update a staging copy when you can, because an update can change checkout behaviour.
Delete plugins and themes you do not use. The hardening guide says to remove unused plugins, and Site Health recommends removing inactive themes. Download WordPress itself only from wordpress.org.
A usable backup holds both the database and the files: core, themes, plugins, uploads, wp-config.php and .htaccess. WordPress's backup guide suggests weekly backups for small, quiet sites, daily for busy ones, and always one before an upgrade, with several recent copies in different places such as your host, cloud storage and your own computer. A shop that takes orders is a busy site.
Testing is the step most people skip. Restore a recent backup to a staging site, check that pages load, products appear and a test order completes. Plugins such as UpdraftPlus or Jetpack VaultPress Backup can schedule backups; check where they store them, because a copy kept only on the same server is lost with it.
admin or webmaster as a username.xmlrpc.php if you do not use it.WordPress ships with Administrator, Editor, Author, Contributor and Subscriber roles. WooCommerce adds Customer and Shop manager, which runs the store without full Administrator access. Give each person the lowest role that does the job: someone who handles orders needs Shop manager, not Administrator. Remove accounts of former staff and agencies, and check that Settings > General > New User Default Role is the lowest role.
The hardening guide says to use plugins only from trusted sources such as the WordPress.org directory. WordPress is released under the GPL, and plugins and themes inherit it, so a lot of WordPress software is legitimately free to use and modify. A nulled copy is something else: a paid theme or plugin with its licence check stripped out and re-uploaded by a stranger. You cannot know what else was changed, it will not receive official updates, and its author is unlikely to support it.
Buy from the author or from a marketplace that issues a licence. On DevMarket a licence key is issued after payment and each item shows its support period and update policy; see the licence terms. If you sell software yourself, read how to price and license your software.
WooCommerce's requirements list HTTPS, and Site Health shows whether your site uses it. To protect logins, add FORCE_SSL_ADMIN once SSL is working on your server.
The hardening guide gives these file permissions: directories 755 and files 644, and wp-config.php readable only by you and the web server (400 or 440). Add these lines to wp-config.php:
define( 'DISALLOW_FILE_EDIT', true );
define( 'FORCE_SSL_ADMIN', true );
define( 'WP_DEBUG', false );DISALLOW_FILE_EDIT removes the theme and plugin file editor for every user, which limits what an attacker can do from a hijacked admin account, though it does not stop malicious uploads. DISALLOW_FILE_MODS goes further and blocks installing and updating plugins and themes, so use it only if you update another way. Keep error display off on a live site: Site Health warns when errors are shown to visitors or logged to a public file.
The hardening guide suggests a firewall plugin, a web application firewall (WAF) or a reverse-proxy service. Your host may provide one. Wordfence describes a firewall, malware scanner and login security, and its free version gets firewall rule updates 30 days after the premium version. Sucuri's free plugin offers auditing, file integrity monitoring and remote malware scanning, with its firewall sold separately.
For monitoring, make sure the administration email address in Settings > General is read by someone, because recovery mode and critical error notices go there. Add your site to Google Search Console, whose Security issues report lists signs that a site was hacked. Keep your host's access and error logs: a scanner tells you that something changed, and logs help you work out how.
wp-config.php with new ones from the WordPress key generator; this logs everyone out. Rotate any API keys stored on the site, such as payment or email keys./wp-admin and /wp-includes with the same version from wordpress.org using SFTP, check .htaccess and the theme files index.php, header.php, footer.php and functions.php, and reinstall plugins and themes from trusted sources.If customer data may have been exposed, ask a lawyer or your data-protection authority what you must report and by when. This guide is not legal advice.
WordPress core receives security updates, and keeping it updated matters. Much of your risk comes from what you add and how you manage access: plugins, themes, passwords and server settings.
Not always. Many hosts supply firewalls and malware scanning. If yours does not, a well-configured plugin helps. Use one tool properly rather than several that overlap.
It can reduce noise in your logs, but the official guidance does not treat it as a main defence. Strong passwords, two-factor authentication and rate limiting do more.
Daily is a sensible default for a store that takes orders, with a backup before any update. Quiet sites can manage weekly, in line with WordPress's handbook.
Security is a rhythm more than a one-off job. This is a suggested one:
| Task | How often (our suggestion) |
|---|---|
| Apply updates, or switch on auto-updates | Weekly |
| Back up database and files | Daily for shops, weekly for quiet sites |
| Test a restore on staging | Every few months, and after big changes |
| Review users and roles | Every few months |
| Read Site Health and security reports | Monthly |
Choose plugins carefully with our guide to the best WooCommerce plugins, keep the store quick with the speed guide, and browse licensed WordPress plugins on DevMarket.
Build an Arabic WordPress website: set the site language, choose an RTL-ready theme and Arabic fonts, decide between Arabic only and bilingual, set URLs and hreflang, and test on a phone.
9 min read
Speed up WooCommerce in the right order: measure Core Web Vitals, fix hosting and PHP, cache safely, shrink images, audit plugins and scripts, then tidy the database and background jobs.
9 min read
There is no honest ranking of the best WooCommerce plugins. Choose by job, check updates, compatibility and HPOS support, keep the stack lean, and use the starter stacks by store size.
8 min read
Every item on DevMarket has a human-reviewed release, an instant licence key and clear update and support terms.