Use this checklist as a maintenance starting point. The right controls depend on your hosting setup, plugins, business needs and the information your website handles.
Keep software maintained
- Update WordPress core, themes and plugins from trusted sources.
- Remove unused themes and plugins rather than leaving them inactive.
- Check that essential extensions are actively maintained and supported.
Protect accounts
- Use unique passwords and multi-factor authentication for administrator accounts.
- Remove accounts that are no longer needed and review user roles.
- Limit administrator access to people who genuinely need it.
Protect files and backups
- Use HTTPS and follow your hosting provider's secure configuration guidance.
- Prevent public access to backups, logs and configuration files.
- Keep backups protected from the main website account where possible and test recovery.
Prepare for unexpected changes
- Know how to contact your hosting provider and domain registrar.
- Monitor for unusual administrator accounts, redirects or content changes.
- Have a clear process for reporting and investigating a suspected compromise.
Need a deeper review?
Explore the WordPress security review service or website security review. Technical testing should only be performed with explicit authorisation.