Your WordPress site went down last Tuesday at 2pm. You don’t know why, and neither does the person who built it three years ago. By the time it comes back, you’d missed four enquiries and your email had bounced for six hours.

This happens to UK businesses every week. WordPress powers around 40% of all websites on the internet, which makes it the most widely used CMS in the world – and the most commonly targeted. The majority of WordPress hacks aren’t sophisticated attacks. They exploit simple, fixable vulnerabilities that have been left unattended.

The good news is that a well-maintained WordPress site is a secure one. This checklist covers the key areas to review, whether you manage your own site or want to know the right questions to ask your agency.

1. WordPress core, theme, and plugin updates

Outdated software is the number one cause of hacked WordPress sites. WordPress itself, along with every theme and plugin you have installed, releases regular updates that include security patches. The longer you leave them and don’t update them, the wider the window for attackers.

What you should be checking:

• Is WordPress running the latest version? (Check under Dashboard → Updates)
• Are all plugins up to date? (Are any plugins or themes abandoned – no updates in 12+ months?)
• Are all themes up to date – including themes you’re not actively using?
• Have you deleted plugins and themes you no longer use?

Deactivated plugins are not safe plugins. They still exist on your server and can still be exploited. If you’re not using something, delete it entirely rather than just switching it off.

A note on updates: WordPress updates should always be tested before being applied to a live site. A reputable support provider will test on a staging environment first, then apply to production – never the other way around.

2. SSL certificate and HTTPS

An SSL certificate encrypts the data passed between your WordPress website and its visitors.

You can tell if you website has an SSL certificate from it having HTTPS at the beginning and the padlock in your browser’s address bar. If you do not have a valid SSL certificate, the website will have HTTP at the beginning and modern browsers will flag it as “not secure” and may even prevent you from visiting the website entirely.

Google and search engines also use this as part of their ranking signals and will see you as lower importance than an equivilant website.

 What you should be checking:

• Does your site load on HTTPS? (Look for the padlock icon in the browser bar)
• Is the SSL certificate valid and not close to expiry?
• Are all pages served securely, including blog posts, contact forms, and any checkout pages?
• Does HTTP automatically redirect to HTTPS? (This is set in WordPress Settings → General, and also at server level)
• Is HTTP Strict Transport Security (HSTS) enabled?

SSL certificates need renewing, typically annually. An expired certificate triggers security warnings that immediately damage visitor trust.

HSTS is worth a special mention. It’s a setting that instructs browsers to never attempt an unencrypted connection to your site – even if someone types “http://” manually. Without it, there’s a brief window during the HTTP-to-HTTPS handoff where an attacker could intercept the connection and redirect a visitor to a fake version of your site. Your developer or hosting provider can enable this with a single server configuration change.

3. WordPress login security and cookie protection

The WordPress login page (/wp-login.php) is one of the most targeted pages on the internet. Automated bots run through thousands of username and password combinations every minute. A few simple changes make a significant difference.

 What you should be checking:

• Have you changed the default admin username? (WordPress defaults to “admin” – a gift to attackers)
• Are all admin accounts using strong, unique passwords?
• Is two-factor authentication (2FA) enabled for all admin logins? (Plugins like WP 2FA make this straightforward)
• Have you limited login attempts to block brute-force attacks? (Wordfence or Limit Login Attempts Reloaded handle this)
• Have you changed or hidden the default /wp-login.php URL?
• Are your site’s cookies set with the Secure and HttpOnly flags?

Former staff members, previous agencies, or freelancers may still have active WordPress logins. Go to Users → All Users and audit who has access. Remove anything that’s no longer needed.

In terms of cookies, when someone logs into your WordPress site, their session is stored in a cookie. If that cookie isn’t properly secured, it can be stolen and used to impersonate them. The Secure flag ensures cookies are only transmitted over HTTPS. The HttpOnly flag prevents browser scripts from reading cookie data – blocking a common attack method called cross-site scripting (XSS). A good WordPress developer will have these configured correctly; it’s worth asking them to confirm.

4. Backups

A good backup strategy is the difference between a serious incident and a minor inconvenience. If your WordPress site is compromised or crashes, a recent backup means you can restore to a clean version quickly.

 What you should be checking:

• Are automated backups running daily? (Plugins like UpdraftPlus or BackupBuddy can handle this)
• Are backups stored somewhere separate from your hosting server – ideally cloud storage like Google Drive, Dropbox, or Amazon S3?
• When did you last test restoring from a backup?
• How far back do your backups go? (Minimum 30 days is recommended)
• Are both your WordPress database and your files being backed up?

When creating back ups, your database holds your content, users, and settings. Your files hold your theme, plugins, and uploads. A backup that only covers one of these isn’t a complete backup.

Storing backups on the same server as your website means a server-level problem could wipe both simultaneously, always use offsite storage for your backups.

5. WordPress hosting environment

Your hosting provider plays a significant role in your overall WordPress security. Budget shared hosting carries more risk because your site sits alongside potentially hundreds of others – if one is compromised, there’s a risk of cross-contamination.

 What you should be checking:

• Is your hosting environment running a PHP version that’s actively supported? (WordPress requires PHP 7.4 minimum; PHP 8.x is recommended)
• Does your host offer a web application firewall (WAF)?
• Is your WordPress installation isolated from other accounts on the same server?
• Does your host provide malware scanning?
• Is there an uptime monitoring system in place?
• Does your server hide its software type and version from public response headers?

That last point is one most business owners never think about, but it matters. By default, web servers often broadcast what software they’re running and which version – information that helps attackers zero in on known vulnerabilities. A good host or support partner will obscure these headers as a matter of course.

Uptime monitoring means that if your site goes down at 3am, someone is alerted immediately – rather than you finding out when you check your emails at 9am, or worse, when a customer mentions it.

6. WordPress forms, user input, and SQL injection

Any point where a user can submit information to your WordPress site is a potential security risk. Contact forms, search boxes, login fields, and WooCommerce checkout pages can all be exploited if not properly secured.

Check these:

• Are your forms protected with CAPTCHA or reCAPTCHA to block automated submissions?
• Is form input validated and sanitised on both the browser and server side?
• Are file uploads (if you accept them) restricted by type and size?
• If you have ecommerce functionality, is your checkout using a PCI-compliant payment gateway like Stripe, PayPal, or Sagepay?
• Is your WordPress theme and any custom code protected against SQL injection?

What we mean by an ‘SQL injection’, is for where people can input or submit data on your website, like forms. When someone submits a form, that data is passed to your database. If the input isn’t properly sanitised, an attacker can type database commands into a form field instead of normal text – and your site will execute them. This can expose every record in your database, from customer emails to order history.

WordPress itself has built-in protections, but poorly coded plugins or custom themes can introduce vulnerabilities. A reputable developer will always use WordPress’s built-in database functions ($wpdb->prepare()) rather than writing raw queries.

Never store card details directly on your site. Payment processing should always be handled by a certified provider – this removes the majority of your PCI compliance burden.

7. Protection against DDoS attacks

A Distributed Denial of Service (DDoS) attack is when a large volume of traffic is directed at your WordPress site simultaneously, overwhelming your server until it can’t respond to legitimate visitors. WordPress sites are frequent targets because they’re so widely deployed.

 What you should be checking:

• Does your hosting plan include DDoS mitigation?
• Is rate limiting enabled to cap the number of requests from a single IP address?
• Is your site behind a CDN (Content Delivery Network) such as Cloudflare?
• Does your web application firewall (WAF) filter suspicious traffic automatically?
• Is your WordPress REST API and XML-RPC endpoint protected or disabled if not in use?

WordPress’s XML-RPC endpoint (/xmlrpc.php) is a particularly common attack vector – it’s a legacy feature that’s often enabled by default but rarely needed on modern WordPress sites. If you’re not using it, it should be disabled. Wordfence and most quality security plugins can handle this.

For most small business WordPress sites, a free or entry-level Cloudflare plan provides meaningful DDoS protection without any technical complexity.

8. WordPress user roles and permissions

WordPress has five built-in user roles: Administrator, Editor, Author, Contributor, and Subscriber. Not everyone needs to be an Administrator. Limiting permissions to what each person actually needs reduces the damage that can be done if an account is compromised.

 What you should be checking:

• Do all users have the minimum role needed for their work? (Are there any accounts with Administrator access that should only be Editor or Author?)
• Are there any old or unused admin accounts still active?
• Is there a process for removing accounts when staff leave?
• Are external agencies or developers only given temporary access – and has it been removed after the project ended?

The fewer people with full Administrator access, the smaller your attack surface. If an account with Editor access is compromised, has access to change your content, whereas an Administrator account can damage your entire site.

9. WordPress security monitoring and scanning

Actively monitoring the website can help identify and catch problems, before something breaks.

 What you should be checking:

• Are you monitoring for file changes on the server?
• Are WordPress security logs being reviewed regularly?
• Do you have alerts set up for unusual activity – failed login attempts, file changes, new admin accounts?
• Is your wp-config.php file protected and outside the web root where possible?

wp-config.php is one of the most sensitive files in any WordPress installation – it contains your database credentials. Most good hosts and security plugins will check its permissions automatically, but it’s worth verifying.

10. GDPR and privacy compliance

Security isn’t only about protecting your site from attackers – it’s also about handling your visitors’ data responsibly. The ICO (Information Commissioner’s Office) can issue fines for data breaches, and poor data handling damages customer trust regardless of legal consequences.

 What you should be checking:

• Is your privacy policy up to date and accurate?
• Are cookies properly disclosed with a compliant consent banner? (Plugins like CookieYes or Complianz can help)
• Is personal data collected through WordPress forms handled and stored securely?
• Have you registered with the ICO as a data controller? (Required for most UK businesses)
• Do you have a process for handling data subject access requests?
• If you’re using WooCommerce, are customer records stored only as long as necessary?

11. Regular WordPress security testing

Running through this checklist once is a good start, but WordPress security isn’t a one-time task. New plugin vulnerabilities are discovered regularly, configurations drift over time, and the threat landscape changes. Regular testing is the only way to know your defences are holding up.

 What you should be checking:

• Are you running a free WordPress security scan periodically? (Sucuri SiteCheck and WPScan are good starting points)
• Has your site had a security review in the past 12 months?
• Are you checking security settings after any major WordPress update, plugin change, or site rebuild?
• Do you have a clear plan for what to do if a vulnerability is discovered?

WPScan maintains a public database of known WordPress vulnerabilities – it’s worth checking your plugins and themes against it. Wordfence also alerts you automatically when a plugin you have installed is found to have a known vulnerability, which is one of the reasons it’s so widely recommended.

How often should you check your website?

Ideally, you should be running a basic WordPress security review every quarter. Some items, such as SSL, user accounts, plugin updates, should be reviewed on a monthly basis. Critical security patches for WordPress core and popular plugins should be applied within days of release (not weeks!).

If this feels like more than your team has capacity to manage, that’s exactly what a WordPress support contract is designed for. A good support partner handles updates, monitoring, backups, and proactive security checks as standard, so you’re not waiting for something to go wrong before acting.

Need someone to manage this for you?

At isev, our WordPress support packages include proactive updates, security monitoring, offsite backups, and regular health checks. We test every update before it goes live and keep an eye on your site so you don’t have to.

Find out more about our WordPress support packages →