When a WordPress website gets hacked, the owner usually asks, "Why would anyone target us?" The uncomfortable answer is that nobody did. Automated bots constantly scan the web looking for known weaknesses - an old plugin, a guessable password, an exposed login page. If your site has one, it gets compromised, whether you are a large brand or a small shop in Jaipur.
The result can be spam pages injected into your site, redirects to gambling or pharmacy websites, Google showing a "This site may be hacked" warning, or your hosting account being suspended for sending spam. Fixing it is far more disruptive than preventing it.
This checklist groups 20 practical checks into six areas. You do not need to be technical to use it - share it with whoever manages your website and ask them to confirm each item.
Area 1: Logins and user accounts
1. Use strong, unique passwords for every admin
Every administrator should use a long, unique password stored in a password manager. Never reuse the password from email or social media.
2. Turn on two-factor authentication (2FA)
2FA means a stolen password alone is not enough to log in. Use an authenticator app for all administrator and editor accounts.
3. Remove or downgrade unused accounts
Former employees, old agencies and one-time freelancers should not still have admin access. Review users regularly and remove anyone who no longer needs access.
4. Apply the least-privilege principle
Not everyone needs to be an Administrator. WordPress has roles - Editor, Author, Contributor, Shop Manager on WooCommerce - for a reason. Give each person the lowest role that lets them do their job.
5. Limit login attempts
Brute-force bots try password after password, around the clock. Limit failed login attempts with a security plugin or server firewall, and consider adding a CAPTCHA to the login form.
Area 2: Updates and software
6. Keep WordPress core updated
WordPress applies minor security releases automatically by default. Make sure this has not been disabled, and plan major version updates promptly after testing.
7. Update plugins and themes on a schedule
Outdated plugins are among the most common entry points for an attack. Update regularly, ideally after testing on a staging copy. WordPress lets you enable automatic updates per plugin, which can suit simple, well-maintained plugins.
8. Remove what you do not use
Deactivated plugins and unused themes can still contain vulnerable code on the server. If you are not using it, delete it. Keep one default theme as a fallback.
9. Never use nulled or pirated plugins and themes
"Free" copies of premium plugins from unofficial websites often contain hidden backdoor code. Buy licences from the original developer or use maintained free alternatives from the official WordPress.org directory.
10. Run a supported PHP version
Old PHP versions stop receiving security fixes. Ask your host which version you are running and move to a currently supported release after testing.
Area 3: Hosting and server
11. Choose hosting that takes security seriously
Good hosting isolates accounts, runs a firewall, monitors for malware and keeps server software updated. Very cheap, overcrowded hosting is a risk, because one compromised account can affect the rest.
12. Use HTTPS everywhere
An SSL certificate encrypts data between visitor and server. Force HTTPS for the whole site, not just the checkout or login.
13. Put a web application firewall (WAF) in front
A WAF filters malicious requests before they reach WordPress. This can be provided by your host, a CDN service or a security plugin.
14. Set correct file permissions and disable file editing
Files and folders should not be writable by everyone. Add the line that disables the built-in theme and plugin file editor in wp-config.php (the DISALLOW_FILE_EDIT setting), so an attacker who gets into the admin cannot easily edit code from the dashboard.
Area 4: Plugins, forms and data
15. Vet every plugin before installing
Before installing a plugin, check when it was last updated, whether it is tested with your WordPress version, how many active installs it has, and how the developer handles support and security reports.
16. Protect your forms
Contact and enquiry forms collect personal data such as names, phone numbers and email addresses. Add spam protection, do not store more data than you need, and make sure submissions are not publicly accessible. India's Digital Personal Data Protection Act, 2023 puts obligations on businesses that process personal data - take advice on what applies to you.
17. Secure third-party connections
API keys for payment gateways, CRMs, WhatsApp tools and email services should be stored securely, not pasted into page content. Rotate keys when a team member or agency with access leaves.
Area 5: Backups and recovery
18. Run automatic, off-site backups
Backups must run automatically and be stored away from the website's server - for example, in cloud storage. If the server is compromised or deleted, a backup on the same server may be lost too.
19. Test a restore
A backup you have never restored is a guess, not a plan. Restore to a staging site occasionally to confirm the files and database are complete.
Area 6: Monitoring and response
20. Monitor and have a response plan
- Set up uptime monitoring so you know when the site goes down.
- Verify your site in Google Search Console, which alerts you to security issues Google detects.
- Use a malware scanner that checks files regularly.
- Write down who to call and what to do if the site is hacked - before it happens.
The checklist at a glance
| # | Check | Owner | Frequency |
|---|---|---|---|
| 1-2 | Strong passwords and 2FA for admins | Each user | Once, then enforce |
| 3-4 | Review users and roles | Site owner | Regularly and on staff changes |
| 5 | Limit login attempts | Developer | Once |
| 6-7 | Core, plugin and theme updates | Developer / maintenance team | Ongoing |
| 8, 9 | Remove unused and pirated software | Developer | Ongoing |
| 10 | Supported PHP version | Host / developer | Review periodically |
| 11-14 | Hosting, HTTPS, WAF, file permissions | Host / developer | Once, then review |
| 15-17 | Plugin vetting, forms, API keys | Developer | On every change |
| 18-19 | Off-site backups and restore tests | Maintenance team | Automated, test periodically |
| 20 | Monitoring and response plan | Owner + developer | Ongoing |
Warning signs your site may already be compromised
- Google search results show your site with strange titles or Japanese/pharmacy keywords.
- Visitors on mobile are redirected to other websites.
- New admin users appear that nobody created.
- Your host warns about high resource usage or outgoing spam.
- Search Console shows a security issue.
If you see any of these, act quickly - the longer malware stays, the harder the clean-up and the bigger the damage to search rankings.
Extra checks for WooCommerce stores
If your WordPress site also runs WooCommerce, the stakes are higher because you handle orders, addresses and phone numbers every day.
- Never store card details yourself. Use a reputable payment gateway so card data is handled on the gateway's side.
- Restrict the Shop Manager role to staff who process orders, and keep Administrator access to a very small group.
- Protect customer exports. Order and customer CSV exports contain personal data - do not leave them in email threads or shared folders indefinitely.
- Watch for fake orders and account spam. Add bot protection to registration and checkout forms.
- Back up the database more often, since new orders arrive all day and a daily backup could miss many of them.
A simple routine you can actually follow
Security fails most often because nobody owns it. Turn the checklist into a routine with a named person responsible:
Every week
- Apply tested plugin and theme updates.
- Glance at the security plugin or firewall log for unusual activity.
- Confirm backups ran successfully.
Every month
- Review the user list and remove anyone who no longer needs access.
- Check Google Search Console for security or manual action messages.
- Delete plugins and themes that are no longer used.
Every quarter
- Restore a backup to staging to prove it works.
- Review the PHP version and hosting configuration with your host.
- Re-read your incident plan and update phone numbers and responsibilities.
Written down and assigned, this routine takes little time and prevents most of the problems we are asked to clean up.
Key takeaways
- Most hacks exploit easy gaps: old plugins, weak passwords and poor hosting.
- 2FA, least-privilege roles and removing old accounts close the login gaps.
- Regular, tested updates are the single most important habit.
- Off-site backups and a tested restore are your safety net.
- Security is an ongoing routine, not a one-time setup.
If you are not sure how many of these 20 checks your website passes, we can help. Our team handles website maintenance and broader cyber security reviews for business websites. Book a free consultation for a security review, or explore our WordPress development services to see how we build sites that are secure from the start.
