Most WordPress security advice is either paranoid overkill for small businesses or dangerously incomplete. Real WordPress security isn’t complicated, but it does require discipline — a specific set of practices done consistently, not a single one-time hardening after a breach scared the business into paying attention.
This is the checklist we actually use with our managed clients. Nothing exotic, nothing that requires enterprise budget, and nothing that’s specifically for high-risk sites. Just the disciplined baseline that keeps normal business WordPress sites out of trouble.
The layers of WordPress security
Security works in layers. Any single layer can fail; the overall posture holds if the other layers are in place. Four layers matter for a typical business site.
The infrastructure layer — the hosting platform your site runs on. The access layer — how users and administrators get into the site. The software layer — WordPress core, themes, and plugins. The monitoring layer — how you know when something’s wrong before it becomes a crisis.
The checklist below covers all four layers in the order that matters most.
The infrastructure layer
Run on real managed hosting, not shared hosting. Cheap shared hosting is the single most common contributor to WordPress compromises. The economics of shared hosting require cutting security investment to the bone. Managed WordPress hosting includes network-level firewalls, DDoS mitigation, WordPress-specific WAF rules, and infrastructure hardening that shared hosting doesn’t. This one change eliminates a large fraction of security risk. We wrote more about this decision in Why Hosting Is a Business Decision.
Verify your hosting includes a web application firewall. A WAF filters malicious traffic before it reaches WordPress. Most managed WordPress hosts include one; verify it’s active for your site. If your host doesn’t include one, add Cloudflare in front of your site or a plugin-based WAF like Wordfence.
Enable SSL and force HTTPS everywhere. Every page on your site should load over HTTPS. Verify this by loading pages in an incognito window and checking for the lock icon in the browser. Any pages loading over HTTP are a warning sign — mixed content is a security issue in itself and hurts SEO.
Verify daily backups are running and can be restored. Managed hosts provide backups automatically. Test the restore process at least once so you know it works. Backups you’ve never tested are theatre, not security.
The access layer
Use strong, unique passwords for every account. Every WordPress administrator account should have a password that’s random, long, and stored in a password manager. Password reuse across sites is one of the most common ways WordPress accounts get compromised — someone reused their email password on WordPress, the email password leaked in a data breach somewhere else, and now the attacker has your admin login.
Enable two-factor authentication on every admin account. Not just yours — every account with admin access. 2FA prevents the majority of credential-based compromises. It’s mildly inconvenient and it stops attacks that would otherwise succeed. There is no serious case against enabling this.
Change the default admin URL. By default, every WordPress site’s login page lives at yoursite.com/wp-admin or yoursite.com/wp-login.php. Automated bots try these URLs constantly. Changing the URL to something non-obvious dramatically reduces login-attempt volume. This alone doesn’t stop a determined attacker who finds the new URL, but it eliminates the automated background noise.
Limit administrator accounts to people who actually need them. Every admin account is a potential vector. Anyone who doesn’t need full admin should have Editor, Author, or Contributor privileges instead. Audit the user list quarterly and remove accounts for former employees, past contractors, or old test accounts.
Never use “admin” or “administrator” as a username. Attackers try these first. Use something specific to the person or the account’s purpose.
The software layer
Keep WordPress core updated within a week of each release. Security patches ship with core updates. Delaying updates leaves known vulnerabilities exposed. Test updates on staging when the site is complex enough to warrant it; apply them promptly regardless.
Keep plugins and themes updated on a regular cadence. Plugin and theme vulnerabilities are the leading cause of WordPress compromises — not WordPress itself, but the third-party code running on top of it. Weekly review, monthly updates as a floor, faster if security issues are announced.
Remove unused plugins and themes. Every installed plugin, active or not, is code on your site. Inactive plugins can still contain vulnerabilities. If you’re not using it, delete it. Same for themes — keep only the active theme and one default fallback.
Only install plugins from reputable sources. The WordPress.org plugin directory, established commercial plugin developers, and well-known theme companies. Avoid plugins from unknown developers, plugins with few installs, plugins that haven’t been updated in a year, and — critically — never install “nulled” (pirated) plugins from unofficial sources. Nulled plugins are one of the most common ways sites get compromised because the pirated version usually contains malware.
Review plugin permissions before installing. Any plugin that requests broad access to your site or its data deserves scrutiny. If a plugin’s function shouldn’t require the permissions it’s asking for, that’s a warning sign.
The monitoring layer
Install a security plugin for monitoring and alerts. Wordfence, Sucuri, or Solid Security (formerly iThemes Security) all provide real-time monitoring, file integrity checking, and login attempt tracking. The free tiers of these plugins are enough for most small business sites.
Set up file integrity monitoring. Get alerted if WordPress core files change unexpectedly. Most compromises involve modifying core files or injecting new files into the site. File integrity monitoring catches this quickly.
Monitor login attempts and block bad actors. Configure your security plugin to limit login attempts by IP and to block IPs after repeated failures. This stops automated brute-force attacks before they succeed.
Check the site’s status regularly. Uptime monitoring services (UptimeRobot has a free tier) alert you when the site goes down. Some monitoring services also check for defacements or unusual response patterns, which catch some kinds of compromises that don’t take the site fully offline.
Review activity logs periodically. Security plugins typically log admin actions, failed logins, and suspicious activity. A monthly review catches problems early. Anomalies — a user account that’s active at unusual hours, plugin changes you didn’t make, files uploaded to the media library that shouldn’t be there — are usually the first sign of a problem.
What to do if you find a compromise
If you find signs of a compromise, act quickly. The full response is in WordPress Site Hacked — the short version is: take the site offline temporarily, change all passwords immediately, restore from a clean backup if you have one, work with a security professional if you don’t, and update everything before bringing the site back online.
The most important part is speed. Compromises get worse the longer they persist. Every hour a compromised site stays online is more damage to SEO, more risk of secondary compromises, and more potential for the attacker to establish additional footholds.
What most businesses get wrong
The single most common mistake is treating security as a one-time hardening rather than an ongoing discipline. A site that was well-secured a year ago and has been neglected since is not well-secured now — plugins have known vulnerabilities that weren’t patched, core is running an outdated version, backups may not be running, and the security posture has drifted from what it was.
The second most common mistake is trusting that “we haven’t been hacked so we must be secure.” Most WordPress compromises are automated and opportunistic — the attackers aren’t targeting you specifically, they’re scanning the internet for vulnerable sites. The fact that you haven’t been compromised yet is not evidence that your security is adequate; it’s evidence that you haven’t been picked yet.
The third is delegating security to a plugin and assuming installation equals protection. A security plugin that isn’t configured, monitored, or acted on is decoration. The plugin is the tool; the discipline of using it is the security.
The ongoing cadence
Real WordPress security is a rhythm, not an event. The cadence we recommend for managed clients:
Weekly: security plugin scans reviewed, critical updates applied. Monthly: full plugin and theme updates, user account audit, backup verification. Quarterly: comprehensive security review including access controls, monitoring configuration, and hosting-level protections. Annually: full security posture assessment and update to the process based on emerging threats.
That cadence keeps sites out of trouble. Skipping it is what turns a healthy WordPress site into a security incident waiting to happen.
Where Lion Ridge fits
Ongoing security is what our managed engagements handle. We run the weekly, monthly, and quarterly cadence on client sites so the business doesn’t have to become a security team. If you’re running WordPress and want to hand this off to someone who does it disciplined, tell us what you’re working with. We’ll give you an honest assessment of where your current security posture is and what it would take to keep the site protected without you having to think about it.
