Most WordPress security problems aren't sophisticated attacks — they're automated bots scanning for the same handful of common weaknesses across millions of sites. This is the checklist I run through before any site goes live, roughly in order of what actually stops the most attacks.
1. Strong credentials and two-factor authentication
"admin" as a username and a simple password is still shockingly common, and it's the very first thing automated attacks try. Every admin account should have a unique username, a strong generated password, and two-factor authentication enabled.
2. Keep core, themes, and plugins updated
The majority of WordPress compromises exploit known vulnerabilities in outdated software — not zero-days. A site running a plugin version with a publicly disclosed vulnerability is an easy, low-effort target. Updates need to happen on a real schedule, not "whenever I remember."
3. Limit login attempts
Without a limit, bots can attempt thousands of password combinations against your login page. A login-attempt limiter (or moving the login URL, or requiring a VPN for admin access on higher-security sites) shuts this down almost entirely.
4. Disable the theme and plugin file editor
By default, WordPress lets anyone with admin access edit theme and plugin files directly from the dashboard. If an attacker ever gets in through a compromised admin account, this editor becomes their easiest way to plant malicious code. I disable it on every site as standard practice.
5. Use a proper security plugin or firewall
A web application firewall filters out malicious requests before they ever reach WordPress — blocking known attack patterns, malicious file uploads, and suspicious traffic. This is one of the highest-leverage single additions to a site's security posture.
6. Real, tested backups
A backup you've never restored from isn't a backup, it's a hope. Automated daily backups stored off-server are non-negotiable, and I test the restore process itself, not just confirm the backup file exists.
7. Force SSL everywhere
Beyond the SEO and trust benefits, SSL prevents data — including login credentials — from being intercepted in transit. Every page, not just checkout or login, should be served over HTTPS with no mixed-content warnings.
8. Hide what you don't need to expose
Removing the visible WordPress version number, changing the default database table prefix, and locking down file permissions won't stop a determined attacker, but they remove the easy, automated wins that most bot traffic is actually looking for.
Why this is a pre-launch checklist, not an afterthought
Every one of these takes minutes to set up before launch and hours (or a client relationship) to fix after a breach. I run through this exact list before handing off any site, because "we'll add security later" is how most compromised WordPress sites ended up that way.
