WordPress Website Security: A Practical Checklist for Small Businesses

For a small business, a WordPress website is often much more than an online brochure.

It may handle customer inquiries, contact forms, bookings, payments, user accounts, email subscriptions, product information, analytics, and other business-critical functions.

That also makes website security a business concern.

A compromised WordPress website can be used to distribute spam, redirect visitors, inject malicious code, steal credentials, damage search visibility, or disrupt normal business operations.

The good news is that small businesses do not need a large security team to establish a strong security baseline.

What they need is a consistent process.

This practical checklist covers the areas that deserve attention when securing a WordPress website.

Why WordPress Security Requires More Than a Security Plugin

A common approach to WordPress security is to install a security plugin and assume the website is protected.

Security plugins can be useful, but they are only one layer of a broader security strategy.

A WordPress installation is made up of several components:

                 WordPress Website
                        │
        ┌───────────────┼────────────────┐
        │               │                │
        ▼               ▼                ▼
   WordPress Core    Plugins           Themes
        │               │                │
        └───────────────┼────────────────┘
                        │
                        ▼
                 Server / Hosting
                        │
                        ▼
                  Database / Files
                        │
                        ▼
                  Domain / DNS

A vulnerability or weak configuration in any of these layers can contribute to a security incident.

That is why effective WordPress security is better understood as a process rather than a single product.

WordPress Security Checklist

Before getting into individual controls, here is a practical baseline checklist.

[ ] Keep WordPress core updated
[ ] Keep plugins and themes updated
[ ] Remove unused plugins and themes
[ ] Use strong, unique administrator passwords
[ ] Enable multi-factor authentication where available
[ ] Review administrator accounts regularly
[ ] Use least-privilege user roles
[ ] Secure hosting and server access
[ ] Use HTTPS
[ ] Maintain reliable backups
[ ] Test that backups can actually be restored
[ ] Monitor for suspicious changes
[ ] Review login activity
[ ] Protect database and configuration files
[ ] Restrict unnecessary access
[ ] Review file permissions
[ ] Keep PHP and server software supported
[ ] Secure third-party integrations
[ ] Scan for malware when appropriate
[ ] Have an incident-response plan

Not every item requires the same level of attention, but together they form a useful security baseline.

1. Keep WordPress Core Updated

WordPress core should be kept up to date.

Security updates can address vulnerabilities that could otherwise be exploited against websites running affected versions.

However, updating should not mean blindly clicking every update button on a production website without considering the site's dependencies.

For important websites, updates should be approached as part of a controlled maintenance process.

A basic workflow is:

New Update
    │
    ▼
Check Compatibility
    │
    ▼
Backup
    │
    ▼
Update
    │
    ▼
Test Website
    │
    ▼
Monitor

For smaller websites, automatic updates can reduce the amount of manual maintenance required for some components.

The important point is to have a maintenance strategy rather than allowing software to become outdated indefinitely.

2. Keep Plugins and Themes Updated

Plugins and themes are an important part of the WordPress ecosystem, but they also expand the amount of software running on a website.

Every additional plugin introduces code that needs to be maintained.

For that reason:

• Keep active plugins updated.
• Keep themes updated.
• Monitor important security announcements.
• Replace abandoned software where necessary.
• Avoid downloading plugins or themes from untrusted sources.
• Remove software that is no longer needed.

A useful rule is:

If you do not need a plugin, do not keep it installed.

Deactivating an unnecessary plugin is not always the same as removing it.

If software is no longer required, removing it reduces the amount of code that needs to be maintained.

3. Remove Unused Plugins and Themes

A website may accumulate plugins over time.

One developer installs a plugin.

Another replaces it with a different solution.

A theme is changed.

A temporary plugin is installed for a migration.

Eventually, the website can contain software that is no longer used.

This creates unnecessary maintenance and security exposure.

A periodic review should identify:

Installed Software
       │
       ├── Required → Keep & Maintain
       │
       ├── Unused → Remove
       │
       └── Suspicious / Abandoned → Investigate & Replace

Keeping the WordPress installation lean is a simple security improvement.

4. Protect Administrator Accounts

Administrator accounts have extensive control over a WordPress website.

If an administrator account is compromised, an attacker may be able to install plugins, modify content, create users, change settings, or upload malicious files.

Administrator accounts should therefore receive stronger protection than ordinary user accounts.

Use:

• Strong and unique passwords
• Multi-factor authentication where available
• Individual accounts for each administrator
• Regular account reviews
• Appropriate user roles
• Secure recovery methods

Avoid sharing one administrator account among several people.

If several people need administrative access, each person should ideally have their own account.

This makes access easier to audit and allows access to be removed when someone no longer needs it.

5. Follow the Principle of Least Privilege

Not every person working on a website needs administrator privileges.

WordPress provides different user roles, and access should generally match the responsibilities of each user.

For example:

Administrator
      │
      ├── Full site management
      │
      ▼
Editor
      │
      ├── Content management
      │
      ▼
Author
      │
      ├── Own content
      │
      ▼
Contributor
      │
      └── Limited content access

The exact roles required depend on the site's workflow.

The security principle is straightforward:

Give users the minimum permissions necessary to perform their work.

This reduces the potential impact of a compromised account.

6. Enable Multi-Factor Authentication

A password is only one authentication factor.

If an administrator's password is stolen through phishing, credential reuse, malware, or another method, an attacker may be able to log in.

Multi-factor authentication adds another verification step.

Depending on the implementation, this might involve:

• An authenticator application
• A security key
• Another supported verification method

For accounts with elevated privileges, MFA can provide an important additional layer of protection.

It should be considered particularly important for administrator and other privileged accounts.

7. Secure Your Hosting Account

WordPress security does not stop at wp-admin.

The hosting account can provide access to the website's files, databases, email configuration, domains, backups, and other resources.

If the hosting account is compromised, an attacker may be able to bypass protections implemented inside WordPress.

Protect hosting access with:

• Strong unique credentials
• MFA where available
• Limited administrative access
• Secure FTP/SFTP rather than insecure file-transfer methods where appropriate
• Regular review of hosting users
• Secure control-panel access

The same principle applies to other infrastructure accounts.

Protect the weakest administrative path, not just WordPress itself.

8. Use HTTPS Everywhere

HTTPS encrypts communication between the visitor's browser and the website.

A properly configured HTTPS website helps protect information transmitted between the browser and server from being exposed or modified in transit.

For a business website, HTTPS should be considered a basic requirement.

After enabling HTTPS, also check for:

• Mixed-content warnings
• Incorrect redirects
• HTTP resources loaded on HTTPS pages
• Certificate problems
• Incorrect canonical URLs
• Plugin or integration compatibility

A secure connection should work consistently across the entire website.

9. Maintain Reliable Backups

Backups are one of the most important parts of a WordPress security strategy.

Prevention is important, but no security control is perfect.

A website may still be compromised through:

• A vulnerable plugin
• Stolen credentials
• Hosting compromise
• Supply-chain issues
• Human error
• A vulnerable integration
• Misconfiguration

A reliable backup can provide a recovery path.

A useful backup strategy should consider:

Website
  │
  ├── Database Backup
  │
  ├── WordPress Files
  │
  └── Configuration / Important Assets
          │
          ▼
      Separate Storage
          │
          ▼
      Recovery Process

Backups should not exist only on the same server as the website.

If an attacker compromises the server and deletes the backups stored there, the organization may lose both the website and its recovery option.

10. Test Your Backups

Having a backup is not the same as having a usable backup.

A backup can fail because:

• It was incomplete.
• Files are corrupted.
• The database is missing.
• Credentials were not preserved.
• The backup process silently failed.
• Restoration steps were never tested.

Businesses should periodically test restoration.

A simple principle is:

A backup is only useful if you can successfully restore from it.

For critical websites, restoration procedures should be documented rather than relying on one person's memory.

11. Review File Permissions

WordPress relies on files and directories to operate.

Incorrect permissions can sometimes allow users or processes to modify files that should be protected.

At the same time, permissions that are too restrictive can cause legitimate WordPress operations to fail.

The objective is not to make every file as restrictive as possible.

The objective is to use appropriate permissions for the hosting environment and application requirements.

Avoid giving unnecessary write access to sensitive files and directories.

12. Protect Sensitive Configuration

The WordPress configuration contains important information about the website's environment.

This can include database connection information and other configuration values.

The configuration should therefore be protected from unauthorized access.

Businesses should also avoid exposing secrets in:

• Public repositories
• Front-end JavaScript
• Publicly accessible files
• Screenshots
• Documentation intended for public distribution

If a credential is accidentally exposed, simply hiding the file afterward may not be enough.

The credential should be rotated.

13. Keep PHP and Server Software Supported

WordPress runs within a broader server environment.

That environment can include:

• PHP
• Web server software
• Database software
• Operating system
• Hosting control panel
• SSL/TLS configuration

Keeping WordPress updated while allowing the underlying server software to become obsolete creates another security gap.

Businesses should therefore know:

WordPress
    │
    ▼
PHP
    │
    ▼
Web Server
    │
    ▼
Operating System / Hosting

Each layer has its own maintenance requirements.

Use supported versions where possible and follow the hosting provider's recommendations for security updates.

14. Review User Accounts Regularly

Website access tends to accumulate.

Former employees may still have accounts.

Old developers may still have administrator access.

Temporary accounts may never have been removed.

Regularly review:

• Administrators
• Editors
• Developers
• Hosting users
• Database users
• SFTP/FTP users
• Third-party integrations

Remove access that is no longer necessary.

For businesses with multiple people managing a website, access reviews should become a routine administrative task.

15. Secure the Login Process

The WordPress login page is one of the most visible attack surfaces.

Automated systems can repeatedly attempt stolen or guessed credentials against login endpoints.

Useful controls may include:

• Strong passwords
• MFA
• Rate limiting
• Login monitoring
• CAPTCHA or other anti-automation measures where appropriate
• Web application firewall protections
• Lockout or throttling mechanisms

The goal is not simply to hide the login page.

Security should focus on controlling authentication attempts and protecting credentials.

16. Be Careful With Security Plugins

Security plugins can provide valuable capabilities such as:

• Malware scanning
• Firewall rules
• Login protection
• File-change monitoring
• Security notifications
• IP or request blocking
• Security configuration checks

But installing several overlapping security plugins can create unnecessary complexity.

Before installing a security plugin, consider:

• What problem does it solve?
• Is the plugin actively maintained?
• Does it duplicate another security control?
• Will it affect website performance?
• Does it require access to sensitive data?
• How will its alerts be managed?
• What happens if the plugin itself becomes vulnerable?

Security tools should be selected as part of an overall security design.

17. Monitor for Unexpected Changes

A compromised website does not always show obvious symptoms.

Attackers may attempt to remain hidden by modifying files, database content, scheduled tasks, user accounts, or redirects.

Monitoring can help identify unexpected activity.

Warning signs can include:

• New administrator accounts
• Unknown plugins
• Unexpected files
• Modified theme files
• Strange redirects
• Unexpected JavaScript
• Unfamiliar scheduled tasks
• Sudden changes in search results
• Unexpected outbound requests
• Unknown login activity

For a small business, even a simple monitoring process can be valuable.

18. Do Not Ignore the Database

WordPress stores much of its important content and configuration in the database.

This can include:

• Users
• Posts
• Pages
• Settings
• Plugin data
• Site configuration

Database security therefore matters just as much as file security.

The database should not be unnecessarily exposed to the public internet.

Database credentials should be protected, and backups should be handled securely.

If a security incident occurs, the database should be investigated alongside the WordPress filesystem.

19. Review Third-Party Integrations

Modern WordPress websites often connect to external services.

Examples include:

• Payment providers
• Email platforms
• Analytics services
• CRM systems
• Marketing tools
• Social media services
• APIs
• Cloud storage
• Shipping platforms

Every integration introduces another relationship that needs to be understood and secured.

Ask:

• What data is being shared?
• What credentials are being used?
• What permissions does the integration have?
• Where are API keys stored?
• Can access be revoked?
• Is the integration still required?

Remove integrations that are no longer necessary.

20. Treat Malware Cleanup as an Investigation

One of the most important lessons in WordPress security is that removing a malicious file does not necessarily solve the underlying problem.

Suppose an attacker places a malicious PHP file on a website.

Deleting that file may make the visible symptom disappear.

But the important question remains:

How did the attacker get in?

A proper investigation should consider:

Malicious File Found
        │
        ▼
Remove / Quarantine
        │
        ▼
Preserve Evidence
        │
        ▼
Review Logs & Accounts
        │
        ▼
Inspect Plugins / Themes / Core
        │
        ▼
Identify Possible Entry Point
        │
        ▼
Close the Vulnerability
        │
        ▼
Reset Compromised Credentials
        │
        ▼
Monitor for Recurrence

If the original entry point remains open, the website can be reinfected.

This is why malware cleanup and security investigation should not always be treated as the same task.

21. Do Not Automatically Trust an Old Backup

Restoring a website from a backup can be an effective recovery technique.

However, an old backup should not automatically be assumed to be clean.

If the compromise existed before the backup was created, malicious code or compromised credentials may already be present.

Before restoring, consider:

• When was the backup created?
• When did the compromise begin?
• Which plugins and themes were installed at that time?
• Were administrator accounts compromised?
• Does the backup contain suspicious files?
• Can the restored site be inspected before going live?

The objective is to restore from a known-good state, not simply an older state.

22. Create an Incident-Response Plan

Small businesses often think about security only after something goes wrong.

A simple incident-response plan can reduce confusion during an actual incident.

It should answer:

• Who is responsible for the website?
• Who controls the hosting account?
• Who controls the domain?
• Who manages backups?
• Who should be contacted if malware is discovered?
• How can compromised credentials be reset?
• How can the website be taken offline if necessary?
• How will customers be informed if the incident affects them?

A basic response process might look like:

Detect
  │
  ▼
Contain
  │
  ▼
Investigate
  │
  ▼
Remove Threat
  │
  ▼
Recover
  │
  ▼
Monitor
  │
  ▼
Learn & Improve

Having this process documented before an incident is much better than creating one during a crisis.

23. Security Is Also About People

Technical controls cannot compensate for every human mistake.

Employees and website administrators should understand common risks such as:

• Phishing
• Password reuse
• Fake plugin downloads
• Suspicious email attachments
• Credential theft
• Social engineering
• Untrusted browser extensions
• Sharing administrator credentials

A strong security culture should therefore accompany technical controls.

For example, if an employee receives a message claiming that their WordPress account needs immediate verification, they should know how to determine whether the message is legitimate before entering their credentials.

24. Establish a Regular Security Routine

WordPress security should not be a one-time project.

A small business can establish a simple maintenance schedule.

Weekly

Check:

• Important updates
• Backup status
• Security alerts
• Suspicious login activity
• Website availability

Monthly

Review:

• User accounts
• Plugins and themes
• Unused software
• Hosting access
• Third-party integrations
• Security notifications

Periodically

Test:

• Backup restoration
• Incident-response procedures
• Administrative access
• Website recovery
• Security controls

The exact schedule should reflect how important and complex the website is.

A Practical Small-Business Security Model

Instead of trying to implement every possible security control, small businesses can build security in layers.

                 ┌──────────────────────┐
                 │    Security Policy   │
                 └──────────┬───────────┘
                            │
                 ┌──────────▼───────────┐
                 │ Identity & Access    │
                 │ Passwords + MFA      │
                 └──────────┬───────────┘
                            │
                 ┌──────────▼───────────┐
                 │ WordPress Software   │
                 │ Core + Plugins       │
                 │ + Themes             │
                 └──────────┬───────────┘
                            │
                 ┌──────────▼───────────┐
                 │ Hosting & Server     │
                 │ PHP + Web Server     │
                 └──────────┬───────────┘
                            │
                 ┌──────────▼───────────┐
                 │ Monitoring & Alerts  │
                 └──────────┬───────────┘
                            │
                 ┌──────────▼───────────┐
                 │ Backup & Recovery    │
                 └──────────────────────┘

Each layer addresses a different part of the problem.

No single layer should be treated as a complete security solution.

The Security Checklist in Priority Order

If a small business has limited time and resources, it can start with the highest-impact fundamentals.

Priority 1: Protect Access

[ ] Strong unique passwords
[ ] MFA for privileged accounts
[ ] Individual administrator accounts
[ ] Remove unnecessary users
[ ] Review hosting access

Priority 2: Reduce Vulnerable Software

[ ] Update WordPress
[ ] Update plugins
[ ] Update themes
[ ] Remove unused plugins
[ ] Remove unused themes
[ ] Replace abandoned software

Priority 3: Establish Recovery

[ ] Automated backups
[ ] Off-site backup storage
[ ] Backup monitoring
[ ] Periodic restoration testing

Priority 4: Secure the Environment

[ ] HTTPS
[ ] Supported PHP version
[ ] Secure hosting
[ ] Appropriate file permissions
[ ] Protected configuration
[ ] Secure database

Priority 5: Monitor and Respond

[ ] Security alerts
[ ] Login monitoring
[ ] File-change monitoring
[ ] Malware investigation process
[ ] Incident-response plan

This provides a practical starting point without requiring a small business to build an enterprise security operation.

Final Thoughts

WordPress security is not about making a website impossible to attack.

No internet-connected system can realistically make that guarantee.

The objective is to reduce unnecessary exposure, protect important accounts and data, detect suspicious activity, and maintain a reliable path to recovery.

For small businesses, the fundamentals are often the most valuable place to start:

• Keep software updated.
• Remove unnecessary software.
• Protect administrator accounts.
• Use MFA.
• Limit privileges.
• Secure hosting.
• Maintain reliable backups.
• Test restoration.
• Monitor important changes.
• Investigate the root cause of compromises.
• Keep the entire technology environment maintained.

Most importantly, security should be treated as an ongoing operational responsibility rather than a checkbox completed once during website development.

A secure WordPress website is not simply one that has a security plugin installed.

It is one that has maintained software, controlled access, protected infrastructure, reliable recovery, monitoring, and a documented response process.