WordPress security doesn't usually come down to one setting or one security plugin. A secure website is the result of several small things being done consistently. Your WordPress installation needs to be updated. Administrator accounts need to be protected. Old plugins should not be sitting around unused. Backups need to exist before you need them. And when something unusual happens, you need a way to notice it quickly.

This checklist covers the main areas worth reviewing on any WordPress website. You don't have to complete everything at once. Start with the basics, then work through the rest as you have time.

Before looking at advanced security settings, make sure the fundamentals are in place. Your website should use HTTPS, your WordPress installation should be maintained, and you should have a working backup that you could actually restore.

HTTPS is no longer something that should be treated as optional. Apart from protecting traffic between visitors and your website, it also prevents browsers from showing unnecessary security warnings.

If you've recently moved your website to a new host or changed your domain configuration, check HTTPS again. Migration and DNS changes can sometimes expose configuration problems that weren't visible before.

An outdated plugin can be a security problem even when the rest of your website is perfectly configured. Make updates part of your regular maintenance instead of waiting until there are dozens of them.

You don't necessarily need to update everything manually every day. What matters is having a reliable process for knowing what needs updating and dealing with it before it becomes a problem.

For business and client websites, keeping track of updates across multiple sites becomes particularly important.

Your WordPress users are part of your security setup. Take a few minutes to look through the user list. You may find old accounts belonging to previous developers, employees, agencies, or people who no longer need access.

Remove accounts that are no longer required and avoid giving administrator access to someone who only needs to publish content.

For each privileged account, check that:

If several people work on the same website, individual accounts are much easier to manage than one shared login. When someone leaves, you can remove their access without changing everyone else's credentials.

Your login page is one of the easiest parts of a WordPress website to find, so it will often receive automated login attempts. You don't need to hide your login page and hope nobody finds it. Focus on protecting the accounts behind it.

Consider using login protection that can detect or limit repeated failed attempts. Two-factor authentication adds another layer of protection if a password is ever exposed. Also check that you aren't exposing unnecessary information through your login and error messages.

For administrators, a strong password combined with 2FA is far more useful than relying on an unusual login URL alone.

WordPress websites tend to accumulate things. A plugin was installed for a test. A second theme was used during a redesign. An old plugin was replaced but never deleted. Over time, these unused components become easy to forget.

Go through your plugins and themes and ask whether each one still has a purpose.

A deactivated plugin is still installed software. If you don't need it, removing it is generally better than leaving it sitting on the website.

Security isn't only about preventing problems. You also need a way to recover when prevention fails. A good backup should contain the information required to bring the website back, including both the database and website files.

Your backup setup should ideally have:

Don't wait for the first emergency to find out whether your backup works. A backup that completed successfully but cannot be restored isn't much use when your website is down.

For important websites, it's worth periodically restoring a backup to a staging environment and checking that the site actually works.

Security problems aren't always obvious. A website can look completely normal to you while containing a compromised file, an unexpected administrator account, or malicious code that only activates under certain conditions. Regular security checks can help identify problems earlier.

Depending on your setup, review:

If a security tool reports an issue, don't simply dismiss it because the website still appears to work. Investigate what was detected and determine whether it is a genuine problem, a false positive, or something that needs further attention.

Security isn't limited to the WordPress dashboard. A website could be technically online while visitors are seeing errors, redirects, broken pages, or an unexpected version of the site.

Basic monitoring can help you notice these problems without waiting for a customer to report them. At minimum, consider monitoring:

For business websites, knowing that a site went offline at 2 AM is much better than discovering it at 9 AM from a customer.

Your WordPress security is only part of the picture. Your hosting account, server panel, SFTP account, SSH access, DNS account, and other services connected to the website can also provide access to your site. Review those accounts as well.

Make sure:

If someone has access to the server itself, WordPress security settings alone cannot protect the entire website.

Websites that accept payments, collect enquiries, or allow users to create accounts need a little more attention. Check that your payment, checkout, membership, and form-related plugins are maintained and configured properly.

You should also review spam protection for public forms and watch for unusual activity such as large numbers of fake registrations or form submissions. For WooCommerce sites, make sure the checkout process still works after important plugin, theme, PHP, or WordPress updates.

If you're looking at this checklist and don't know where to start, don't try to fix everything at once.

Start with these:

You don't need to spend an entire day auditing a small website every month.

A quick review can catch things that are easy to overlook.

If everything looks good, you're done. If something doesn't look right, investigate it before it becomes a bigger problem.

There isn't a single WordPress setting that makes a website secure forever. A well-maintained website is one where updates are handled, access is controlled, backups are available, unnecessary software is removed, and problems are noticed early.

You don't need to implement every advanced security technique to get the basics right. Start with the fundamentals and build a maintenance routine around them. If you manage multiple WordPress websites, keeping track of all of this manually becomes much harder. That's where centralized monitoring, updates, backups, security checks, and alerts can save a considerable amount of time.

Use this checklist as a starting point, then revisit it regularly as your website and team change.