The Ultimate WordPress Security Checklist: 10 Steps to Stop Hackers

WordPress is the most popular content management system in the world, powering over 43% of all websites. However, this popularity makes it a prime target for hackers and automated bots. If your website security is weak, malware injections can crash your site, steal customer data, and ruin your Google search rankings.

Here is a 10-step security hardening checklist that you should implement today.

1. Keep Core, Themes, and Plugins Updated

The single most common cause of hacked sites is outdated software. Developers constantly patch security vulnerabilities.

• Enable automatic updates for minor core versions.
• Audit your plugins monthly and delete any that are deactivated or no longer supported.
• Never use “nulled” or cracked versions of premium plugins; these almost always contain backdoors.

2. Upgrade to a Secure Web Host

Your host provides the foundational security for your site. Cheap shared hosting plans often lack proper isolation, meaning if another site on the server gets hacked, yours is vulnerable too.

• Choose managed WordPress hosting (e.g. Kinsta, WPEngine) or configure a dedicated Cloud VPS.
• Ensure your host uses the latest PHP versions (PHP 8.2 or higher).

3. Protect Your wp-config.php File

The wp-config.php file contains your database passwords and site salts. It is the target of every database injection attack.

• Move the file one directory level above your WordPress root directory (WordPress automatically checks parent folders).
• Change file permissions to 600 or 440 so other server users cannot read it.
• Block access in your .htaccess file:

  <Files wp-config.php>
  order allow,deny
  deny from all
  </Files>

4. Change the Default Admin Login URL

By default, the admin page is located at domain.com/wp-admin or domain.com/wp-login.php. Brute-force bots scan these URLs endlessly.

• Use a plugin like WPS Hide Login to change the login page path to something unique (e.g. /my-portal or /admin-access).
• This stops 99% of automated brute-force attacks instantly.

5. Implement Two-Factor Authentication (2FA)

Even if a hacker guesses your password, they cannot gain access without your phone’s verification code.

• Install plugins like Wordfence or Solid Security to enable 2FA for all administrative accounts.
• Force administrators to choose complex, unique passwords.

6. Set Proper File Permissions

Incorrect folder permissions allow hackers to upload and execute PHP scripts.

• All folders should be set to 755.
• All files should be set to 644.
• Never leave files set to 777.

7. Disable File Editing inside the Dashboard

WordPress includes a built-in code editor in the admin panel. If a hacker steals your admin password, they can use this editor to write backdoors into your files.

• Disable this feature by adding the following line to your wp-config.php file:

  define('DISALLOW_FILE_EDIT', true);

8. Disable XML-RPC

XML-RPC allows external applications to communicate with your website. Unfortunately, hackers use it to attempt thousands of password guesses in a single request.

• Add this code block to your .htaccess file to disable XML-RPC access:

  <Files xmlrpc.php>
  order allow,deny
  deny from all
  </Files>

9. Set Up a Web Application Firewall (WAF)

A WAF filters out malicious traffic before it ever reaches your server.

• Use cloud-based services like Cloudflare (free or paid) to block DDoS attacks, SQL injections, and bad bots.
• Alternatively, use application-level firewalls like Wordfence or Sucuri.

10. Perform Scheduled Automated Backups

No security setup is 100% hacker-proof. Having reliable backups ensures you can restore your site in minutes if an intrusion occurs.

• Back up your database daily and files weekly.
• Store backups on an external cloud (e.g. Dropbox, Amazon S3, Google Drive), never on the same server as your website.

Implementing these steps will keep your site safe from most automated hacking campaigns. If your website is already hacked or showing symptoms of redirects, check out our WordPress Malware Removal guide to clean your server.