Website security guide
A WordPress security checklist you can finish in an afternoon
WordPress is safe when it is maintained. Most compromised WordPress sites were not maintained. Here is the short list.
The checklist
- Update core, themes and plugins. Turn on automatic minor and security updates.
- Delete what you do not use. An inactive plugin can still be exploited.
- Protect the login. Limit attempts, require two-factor sign-in for every administrator, remove old admin accounts.
- Disable XML-RPC unless a plugin genuinely needs it.
- Remove giveaways:
readme.html, the generator tag, directory listings on uploads. - Make sure no backups or config copies sit in the web root.
- Take daily off-site backups and test a restore. An untested backup is a hope, not a backup.
- Put a firewall in front of the site.
- Keep PHP on a supported, patched release. See PHP2Shell.
A free Feli-Scan checks most of this list from the outside in under 30 seconds.
Questions people actually ask
Before you call
Do I need a security plugin?
A good one helps with login protection and alerts. It does not replace updates, backups or a firewall in front of the server, and it cannot protect against a flaw in PHP itself.
Still have the question?
Ask us directly. We answer these on calls all day.