WordPress Security Checklist for Small Business Owners

Every week, we get a call from a business owner whose WordPress site is down, defaced, or quietly redirecting visitors to a pharmacy ad in Russian. Almost none of them saw it coming. WordPress powers a huge share of the web, and that popularity makes it a constant target. Automated attack bots scan millions of sites a day, looking for the same handful of weaknesses.

The good news: most WordPress hacks don’t come from sophisticated attackers. They come from a handful of preventable gaps. This checklist covers the fixes we apply on every site we maintain. It’s built from years of cleaning up hacked WordPress installs, and the patterns we see repeat again and again.

Why WordPress Sites Get Hacked

Before the fixes, it helps to understand the actual attack paths. Attackers rarely break WordPress’s core code directly. Instead, they target the layer around it — plugins, themes, login pages, and server configuration.

• Outdated plugins and themes. A plugin’s known vulnerability is public information. Security researchers publish the details, and bots weaponize the exploit within days.
• Weak or reused admin passwords. Credential-stuffing bots try passwords leaked from other breaches against thousands of WordPress login pages at once.
• No firewall in front of the site. Without a Web Application Firewall (WAF), malicious requests reach your server and your plugins directly. Nothing filters them out first.
• Nulled or pirated plugins. “Free” premium plugins downloaded from unofficial sites often ship with hidden backdoors already installed.
• No backups. This doesn’t cause a hack, but it turns a one-hour fix into a multi-day disaster recovery project.

1. Lock Down Admin Access

Your wp-admin login is the front door. Most attacks try to walk straight through it.

• Use a unique, long password for every admin account. Never reuse a password from another site. A password manager makes this painless.
• Turn on two-factor authentication. Even a stolen password becomes useless without the second factor.
• Rename or remove the default “admin” username. Attackers assume it exists and target it first.
• Limit login attempts. Plugins like Limit Login Attempts Reloaded block an IP address after a handful of failed tries. That alone stops brute-force scripts cold.
• Remove unused admin accounts. Every former employee or old developer account is a door you forgot to lock.

2. Keep Everything Updated — Automatically Where Possible

WordPress core, themes, and plugins all receive security patches regularly. The problem isn’t that updates don’t exist. It’s that businesses delay applying them, sometimes for months, out of fear something will break.

We manage update cycles for clients for exactly this reason. “We’ll do it eventually” is how sites get hacked. A structured approach works better:

• Enable automatic updates for minor WordPress core releases. These are almost always security fixes.
• Review and apply plugin and theme updates weekly, on a staging copy first if the site is business-critical.
• Remove plugins and themes you no longer use instead of leaving them deactivated. An inactive plugin with a vulnerability is still an open door.
• Subscribe to a vulnerability feed like WPScan’s database. You want to know about a critical flaw before it’s exploited at scale, not after.

3. Put a Web Application Firewall in Front of Your Site

A WAF inspects incoming traffic and blocks known attack patterns — malicious SQL, script injection attempts, known bad IP ranges — before they ever reach WordPress. We treat this as non-negotiable for any client site handling customer data or payments.

You have two practical options:

• A network-level WAF such as Cloudflare or Sucuri, which filters traffic before it hits your server at all.
• An application-level firewall plugin such as Wordfence, which inspects requests inside WordPress itself and can also scan your files for malware.

Running both gives you layered protection. The network WAF stops the bulk of automated noise. The plugin catches anything that gets closer.

4. Fix File and Database Permissions

Incorrect file permissions are one of the quieter causes of compromise. If your web server can write to files it shouldn’t touch, a single vulnerable plugin can be used to plant malicious code anywhere on the site.

• Set folders to 755 and files to 644 as a general rule. Avoid 777 permissions entirely.
• wp-config.php should be locked down further, since it holds your database credentials.
• Use a unique table prefix instead of the default wp_. It makes automated SQL injection attempts slightly harder to script generically.
• Create a dedicated database user for each site with only the privileges it actually needs. Don’t share one admin-level database account across multiple sites.

5. Disable What You Don’t Use

XML-RPC, for example, is a legacy WordPress feature that allows remote publishing and pingbacks. Most sites never use it, yet it remains a favorite target for brute-force and DDoS amplification attacks. If you don’t rely on it for a mobile app or a specific integration, disable it entirely.

The same logic applies to file editing from the dashboard (DISALLOW_FILE_EDIT in wp-config.php), REST API endpoints you don’t use, and any plugin feature exposing more surface area than your business actually needs.

6. Back Up Like You Expect to Need It

Security measures reduce risk, but nothing brings it to zero. A tested backup is what turns a hack from a catastrophe into an inconvenience.

• Back up both files and the database, on an automated daily schedule for active sites.
• Store backups off-server. A backup sitting on the same compromised server can be encrypted or deleted along with everything else.
• Actually test a restore occasionally. A backup you’ve never restored from is a backup you’re only assuming works.

7. Monitor for Change

Most hacked sites don’t get noticed for days or weeks, because nobody was watching. File integrity monitoring tools flag unexpected changes to core files. Malware scanners catch injected code before Google flags your domain as unsafe for visitors. Catching an intrusion on day one instead of day thirty is the difference between a quick cleanup and a full rebuild.

Putting It Into Practice

None of these fixes are complicated or expensive individually. The real risk comes from treating security as a one-time setup task instead of ongoing maintenance. We run this exact checklist across every WordPress site we manage. The sites that get compromised are almost always the ones nobody was actively watching.

If you’re not sure where your own site stands on any of these points, that uncertainty is usually the clearest sign it’s time for a proper audit.

Frequently Asked Questions

How often should I update WordPress plugins and themes?

Check weekly at minimum, and apply security-related updates immediately rather than batching them. Critical vulnerabilities get exploited within days of disclosure. Delaying a patch for a “convenient” time only widens your exposure window.

Is a security plugin enough, or do I still need a WAF?

A security plugin like Wordfence includes a basic application-level firewall, which helps significantly. However, a network-level WAF such as Cloudflare stops malicious traffic before it reaches your server at all. That reduces server load and blocks attacks that never even touch WordPress. We recommend using both together for business-critical sites.

How do I know if my WordPress site has already been hacked?

Common signs include unexpected redirects, new admin users you didn’t create, unfamiliar files in your plugin or theme folders, a sudden drop in search rankings, or a browser warning flagging the site as unsafe. If you notice any of these, isolate the site and get a security audit immediately. Don’t attempt fixes that might overwrite evidence of how the attacker got in.

Can nulled or pirated plugins really contain malware?

Yes, and it’s extremely common. Nulled plugins are premium plugins with their licensing checks removed, redistributed through unofficial sites. Attackers frequently inject backdoor code into these files before distributing them. That gives them persistent access to every site that installs them. The “savings” from a free nulled plugin rarely justify the risk.

Keeping a WordPress site secure takes ongoing attention, not a one-time setup. Our WordPress development and maintenance services cover exactly this — updates, hardening, monitoring, and rapid response if something does go wrong. If you’d like us to review your current setup, get in touch with our team and we’ll walk you through where you stand.