The WordPress Security Checklist for 2026: 25 Checks That Catch 95% of Hacks

WordPress now powers roughly 41% of all websites on the internet — which also makes it the most attacked CMS on the planet. Automated bots don't care how small your site is; they probe millions of sites per hour looking for one outdated plugin, one weak password, one exposed endpoint.

The good news: the vast majority of successful WordPress hacks exploit a short, boring list of well-known weaknesses. Work through this 25-point checklist and you'll close the doors that account for the overwhelming majority of breaches.

We've grouped the checks the same way our audit engine does at Ultimate WP Audit — you can run every one of them automatically (free, no admin password needed) or verify them manually.

Section 1: Access & Authentication

  1. No "admin" username. The most tried username on earth. If it exists, create a new admin account and demote/delete this one.
  2. User enumeration is blocked. Visit yoursite.com/?author=1. If it reveals a login name, attackers are halfway to a brute-force.
  3. Two-factor authentication on every admin account. Passwords leak; second factors rarely do.
  4. Login rate limiting is active. Unlimited password guesses = eventual success.
  5. XML-RPC is disabled or restricted unless you specifically use it (it's a brute-force amplifier).
  6. REST API user endpoints are locked down. /wp-json/wp/v2/users should not list your authors' login names to the world.

Section 2: Updates & Code Hygiene

  1. WordPress core is current. Every day on an old version is a day with known, published exploits in the wild.
  2. Every plugin is updated — and every plugin you don't use is deleted, not just deactivated. Deactivated plugin code is still executable.
  3. Themes are updated, and unused themes are removed (keep one default fallback).
  4. No nulled/pirated premium plugins. "Free" premium plugins are the #1 malware delivery vehicle in WordPress.
  5. PHP version is 8.1+. End-of-life PHP no longer receives security patches — your host can usually switch this in one click.
  6. Database table prefix is not wp_. It won't stop a determined attacker, but it kills a whole class of automated SQL-injection bots.

Section 3: Server & Headers

  1. HTTPS everywhere, with HTTP permanently redirecting to HTTPS.
  2. HSTS header active (Strict-Transport-Security) so browsers refuse insecure connections.
  3. X-Frame-Options or CSP frame-ancestors set, blocking clickjacking.
  4. X-Content-Type-Options: nosniff prevents MIME-sniffing attacks.
  5. A Content-Security-Policy exists — even a basic one dramatically limits XSS damage.
  6. Directory listing is disabled (Options -Indexes). Attackers shouldn't browse your uploads folder.
  7. wp-config.php is not web-accessible and file permissions are tight (644 files / 755 directories as a baseline).

Section 4: Monitoring & Recovery

  1. You have automated, off-site backups — and you have tested a restore in the last 90 days. An untested backup is a hope, not a backup.
  2. Uptime monitoring alerts you within minutes — a hacked site is often defaced or taken down before you notice anything else.
  3. File-integrity monitoring tells you when core files change unexpectedly.
  4. You know every admin-level user on the site. Old contractor accounts are silent backdoors.
  5. Error messages don't leak server paths. Display errors off in production, always.
  6. You have a written incident plan: who you call, how you restore, what you tell customers. The middle of a breach is the wrong time to improvise.

The 60-second version

Manually verifying 25 checks takes an afternoon — which is exactly why most site owners never do it. We built Ultimate WP Audit to run all of these (plus 230+ more across performance, SEO, accessibility, and database health) automatically:

  • No WP admin password required — a lightweight, read-only agent plugin does the work
  • AI-written fix recommendations prioritized by severity
  • PDF reports you can hand to a client or your boss
  • Free plan: 1 site, 5 scans/month — no credit card

Run the free audit on your site →

If your score surprises you, you're in good company — it surprises almost everyone the first time.