WordPress is secure at its core, but websites get hacked when basic care is skipped. Use this checklist to protect your business, your customers and your search rankings.

Logins and users

1. Use strong, unique passwords for every user, and a password manager to store them.
2. Turn on two-factor authentication for all admin accounts.
3. Limit login attempts to stop bots guessing passwords.
4. Give users only the access they need. Not everyone needs to be an administrator.
5. Remove old user accounts for people who no longer work with you.

Updates

6. Keep WordPress core updated.
7. Update themes and plugins regularly — most hacks use known holes in outdated plugins.
8. Delete unused plugins and themes, even if they are deactivated.
9. Only install plugins from trusted sources. Never use “nulled” premium plugins.

Hosting and server

10. Choose a secure host with firewalls and malware scanning.
11. Use HTTPS with a valid SSL certificate on every page.
12. Run a recent PHP version.

Backups and monitoring

13. Take daily off-site backups and test that you can restore them.
14. Add a web application firewall to block attacks before they reach your site.
15. Monitor uptime and file changes so you know straight away if something goes wrong.

What to do if you get hacked

Don’t panic. Change all passwords, restore a clean backup if you have one, and find out how the attacker got in — otherwise it will happen again. If you are not sure what to do, get expert help quickly to limit damage to your rankings.

Security is not a one-time job. A little regular care prevents most problems.

Our maintenance and security plans take care of every item on this list for you — and we also clean and secure hacked websites.

Further reading

• Hardening WordPress (WordPress.org)
• WordPress backups (WordPress.org)