WordPress Security Checklist for Small Business Sites

A WordPress security checklist for a small business comes down to six habits: keep core, plugins and themes updated, lock down logins with strong passwords and two-factor authentication, remove what you don’t use, block attacks before they reach PHP, keep off-site backups you have actually tested, and watch for changes. None of this needs a large budget. It needs someone to do it every week.

I’m Zain Saeed, a WordPress and Shopify developer. I’ve shipped 120+ projects over 8+ years and won Fiverr’s Millionaire Award for $1M+ in orders. Cleaning up hacked client sites is part of that work, and almost every one I’ve seen was missing at least two items on this list.

Here is the short version. Print it, or paste it into your task manager. The sections below explain each item and how to check it.

Area	What to do	How often
Updates	Update core, plugins and themes; delete unused ones	Weekly
Logins	Unique passwords, 2FA for every admin, no shared accounts	Set once, review quarterly
Users	Remove old admins and give people the lowest role that works	Quarterly
Login protection	Rate-limit wp-login.php, restrict or disable XML-RPC	Set once
Configuration	Disable the dashboard file editor, correct file permissions, HTTPS everywhere	Set once
Backups	Automatic off-site backups of files and database; test a restore	Daily backups, restore test quarterly
Monitoring	Uptime checks, activity log, malware scan, new-admin alerts	Ongoing

1. Keep WordPress core, plugins and themes updated

The official WordPress hardening guide is clear on this: run the latest version, because older versions lack security patches and their weaknesses are public. In my experience, an outdated plugin is the most common way into a small business site.

• Turn on auto-updates where it’s safe. Since WordPress 5.5 you can enable automatic updates plugin by plugin and theme by theme from the Plugins and Appearance screens. WordPress checks for them twice a day and emails you after each attempt, according to the WordPress auto-updates documentation.
• Update large plugins by hand. WooCommerce, page builders and membership plugins can break layouts or checkout. Update these on a staging copy first, or at least right after a fresh backup.
• Delete what you don’t use. A deactivated plugin still sits on the server, and its files can still be attacked. If you don’t need it, delete it. The same goes for old default themes. Keep one spare.
• Drop abandoned plugins. If a plugin hasn’t had an update in a year or more, look for a maintained replacement.

If you have WP-CLI access, this shows what is out of date in a few seconds:

wp core check-update
wp plugin list --update=available
wp theme list --update=available

2. Lock down logins and block login attacks

Most attacks on WordPress are bots guessing passwords. The WordPress brute force guide recommends strong, unique passwords kept in a password manager, plus two-factor authentication for every administrator and privileged user. WordPress core does not include 2FA, so you add it with a well-maintained plugin or through single sign-on.

• One person, one account. Never share an admin login between staff or with a developer. Give each person their own account so you can remove it when they leave.
• Use the lowest role that works. A person who writes blog posts needs Editor or Author, not Administrator.
• Review the user list every quarter. Go to Users and filter by Administrator. If you don’t recognize an admin account, treat it as a possible hack, not a mystery.
• Check application passwords. Each user’s profile has an Application Passwords section. These let outside tools log in without 2FA. Revoke any you didn’t create.
• Avoid “admin” as a username. It is the first name bots try. Create a new administrator with a different username, move the content to it, and delete the old one.

Block login attacks before they reach WordPress

Login-limit plugins help, but the brute force guide points out that they still run inside PHP, so a heavy attack can still slow your site. It recommends rate-limiting login attempts at the firewall, CDN or web server level instead.

• Put a web application firewall in front of the site. Cloudflare or your host’s firewall can rate-limit /wp-login.php and /xmlrpc.php and drop known bad traffic before it reaches your server.
• Disable XML-RPC if nothing uses it. The same guide calls xmlrpc.php a frequent brute-force target. Some tools still use it, such as the Jetpack plugin and older mobile apps. If yours do, restrict it rather than turning it off.
• Turn on HTTPS everywhere. Your login form and contact forms should never send data over plain HTTP. Most hosts provide a free certificate.

3. Harden the WordPress configuration

These are one-time changes. They take a developer about an hour on most sites.

• Disable the built-in file editor. If someone gets into an admin account, the theme and plugin editor lets them change code from the browser. Add this line to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

• Set correct file permissions. The hardening guide’s standard is 644 for files and 755 for folders. Only wp-content needs to be writable by the web server. Never use 777.
• Keep PHP and hosting software current. The hardening guide recommends choosing a host that runs current software versions and offers reliable backups. Check Tools > Site Health. It flags an outdated PHP version.
• Protect wp-config.php. This file holds your database password. Make sure it can’t be downloaded or read in a browser, and that no backup copies of it (like wp-config.php.bak) are lying in public folders.

Some checklists tell you to change the database table prefix from wp_. The hardening guide mentions it, and it does no harm on a new install. On a live site the change is risky and the gain is small, so I would put it last on the list.

4. Back up off-site and test a restore

Backups are what turn a hack from a disaster into a bad afternoon. The hardening guide recommends regular snapshots of the whole installation, and the WordPress auto-updates documentation recommends making sure you can roll back before you turn on auto-updates.

• Back up both files and the database. A database-only backup loses your uploads, and a files-only backup loses your content and orders.
• Store copies off the server. If the backup lives on the same server as the site, a hack or a server failure can take both. Send copies to cloud storage that your WordPress login can’t delete.
• Match frequency to how often the site changes. A brochure site can get by with daily backups. A busy WooCommerce store needs more frequent database backups so you don’t lose orders.
• Test a restore. Restore a backup to a staging site at least once a quarter. A backup you have never restored is a guess.

5. Monitor the site so you notice problems early

Many hacks run quietly for weeks. Spam pages get added for search engines, or visitors get redirected only on mobile, and the owner sees nothing in the dashboard. Monitoring is how you catch it.

• Uptime monitoring that emails you when the site goes down.
• An activity log that records logins, new users, plugin installs and settings changes. The hardening guide recommends logging so you can work out what happened after an incident.
• Malware scanning from your host or a security plugin, plus Google Search Console, which alerts you if Google detects hacked content or spam on your site.
• Alerts for new administrators. A new admin you didn’t create is the clearest sign of a break-in.

If you already see warning signs, such as unknown admins, spam pages in Google results or redirects, don’t just update and hope. The site needs a proper cleanup, with every password reset afterward. My website maintenance service covers both cleanups and ongoing care.

What you can do yourself and what to hand off

An owner can handle most of the account items: passwords, 2FA, removing old users and turning on auto-updates for simple plugins. Those take an hour and need no code.

The server-side items are worth handing to a developer or your host. That means firewall rules, XML-RPC, file permissions, wp-config.php changes, off-site backups and restore tests. One wrong edit to wp-config.php can take the site offline. If you run several client sites as an agency, I also offer white-label WordPress maintenance. Your theme choice affects security too. A theme that leans on a dozen add-on plugins gives attackers more to work with, which I cover in how to choose a WordPress theme.

Frequently asked questions

Do I need a security plugin for WordPress?

A security plugin helps with scanning, activity logs and 2FA, but it is not a replacement for updates, backups and a firewall in front of the site. Use one well-maintained plugin. Several overlapping security plugins slow the site and can conflict.

Is it safe to turn on automatic plugin updates?

For small, well-maintained plugins, yes, as long as you have recent backups. For WooCommerce, page builders and other large plugins, update by hand after a backup or test on staging first.

How often should I check WordPress security?

Check updates weekly. Review users, application passwords and plugins every quarter, and test a backup restore at the same time. Monitoring and backups should run automatically every day.

Does WordPress have built-in two-factor authentication?

No. WordPress core does not ship 2FA. You add it with a reputable plugin or through a single sign-on provider, and you should require it for every administrator.

What should I do first if my site is hacked?

Put the site in maintenance mode or take it offline, keep a copy of the hacked files for investigation, then clean or restore from a known-good backup. After that, update everything, remove unknown users and reset every password, including hosting, database and FTP.

If you want a fixed-price quote for securing or maintaining your WordPress site, send me a short brief and I’ll tell you what it will take.