The WordPress security checklist
Work down this list on the live site. Stop and fix a failed item before you add another plugin.
| Check | What to do |
|---|---|
| Updates | Update WordPress core, then themes, then plugins. Delete anything you do not use. |
| Admin account | Do not use the username admin. Use a long unique password and two-factor login. |
| Login | Limit failed attempts. Turn off XML-RPC if the mobile app and Jetpack do not need it. |
| HTTPS | Force the certificate, then replace leftover http links. See the HTTP to HTTPS guide. |
| Editor | Set DISALLOW_FILE_EDIT to true so a stolen admin session cannot edit PHP in the browser. |
| Theme | Install from WordPress.org or a vendor you pay. Delete unused themes. Never upload a nulled zip. |
| Backup | Keep a copy off the server and restore it once so you know the file opens. |
If you want this run for you, the WordPress security service is the engagement. The checklist itself is the work either way.
Website security for the WordPress login
The login is the door people guess. Create a new administrator with a name that is not admin, log in as that user, and delete or demote the old admin account. Turn on an authenticator app for two-factor. SMS codes are easier to intercept, so use them only if the app is impossible.
- Limit login attempts so a script cannot try thousands of passwords.
- Disable XML-RPC if you do not publish from a phone app that requires it. It is a common password-guessing target.
- Give editors and authors only the role they need. An editor account should not install plugins.
WordPress theme and plugin security check
A theme security check is short. The theme should come from the WordPress directory or from a seller you can pay again for updates. Open Appearance, then Themes, and delete every theme you are not running, including old defaults you will not switch back to. An unused theme is still code.
Do the same for plugins. If a plugin has not been updated by its author in a long time and you can replace it, remove it. A security plugin can block some bad requests, but it does not replace updates. WordPress hosting still needs this list; the host does not patch your plugins for you unless the plan says managed updates.
WordPress setup checklist for a new site
- Create the first administrator with a unique name and a long password, then turn on two-factor.
- Install the certificate and set both URL fields to https.
- Add DISALLOW_FILE_EDIT in wp-config.php.
- If the site was copied from another install, replace the salts in wp-config.php so old cookies die.
- Take the first off-site backup before you add client content.
- Remove the default hello post, unused themes and any demo plugin the installer added.
A website-building checklist, a UX review and an office network checklist are different jobs. They are not extra headings here.
A backup you can restore
A backup you have never restored is a hope. Once a month, download the archive and confirm it contains the database and wp-content. Once a year, restore it onto a staging copy and click the home page.
Store the archive off the same server. If the account is compromised, a backup sitting in public_html goes with it. Email support@webji.services if you need the host copy checked. Phone +91 141 4941811 is business hours only.
Frequently Asked Questions
How do I secure my WordPress site?
Update core, themes and plugins, delete what you do not use, replace the admin username, add two-factor login, force HTTPS, turn off the file editor, and keep an off-site backup you have restored once.
What are the most important WordPress security steps?
Updates, a unique administrator with two-factor login, and a backup you can restore. The other rows in the checklist matter, and these three stop the common failures.
How do I stop my WordPress site from being hacked?
You lower the chance. Remove unused plugins and themes, stop password guessing, and do not install a theme from an unknown zip. No checklist makes a site impossible to break.
Do I need a WordPress security plugin?
A firewall plugin can block some bad requests. It does not update abandoned plugins or fix a weak admin password. Treat it as an extra layer, not the checklist.
Should I disable XML-RPC?
Yes, if you do not use the WordPress mobile app or another tool that posts through XML-RPC. It is a frequent target for password guesses. Leave it on only when a tool you use requires it.
How do I add two-factor authentication to WordPress?
Install an authenticator plugin, enrol an app on your phone for the administrator, and store the backup codes somewhere that is not the same server.
Is WebJi® an Indian company?
Yes. WebJi® is headquartered in Jaipur, Rajasthan and has operated since 2005. Billing, support and governance all run from India.
Do you provide GST invoices?
Every purchase and renewal gets a GST invoice with our GSTIN, and hosting prices are quoted exclusive of 18% GST. Claim input credit as applicable.