Most WordPress sites are not hacked through clever exploits — they are hacked through an outdated plugin, a reused password or an abandoned admin account. This audit takes twenty minutes and closes the common doors.
1. Update everything (3 minutes)
Update WordPress core, themes and plugins. Most attacks exploit known vulnerabilities that already have patches. Delete any theme or plugin you are not using — inactive code is still a risk. Enable automatic updates for core and, if you trust the plugin, for plugins too.
2. Audit user accounts (3 minutes)
Go through every account and ask:
- Should this person still have access?
- Do they have the lowest role they need?
- Is there an old admin or editor account from years ago?
- Are you still using the username
admin?
Remove what you cannot justify. Accounts for people who have left are the most common oversight.
3. Turn on two-factor authentication (4 minutes)
Install a 2FA plugin and enable it for every administrator, editor and author. Save the backup codes in your password manager. This single step blocks the overwhelming majority of automated login attacks.
4. Protect the login page (3 minutes)
- Limit login attempts
- Use strong, unique passwords everywhere
- Consider changing the login URL to reduce bot noise
- Disable the file editor in
wp-config.phpso a compromised admin cannot edit plugin files
5. Verify backups actually work (3 minutes)
Confirm backups are running, stored off-site, and recent. Then check the restore process — a backup you have never tested is not a backup. This is the control that turns a disaster into an inconvenience.
6. Check hosting-level security (2 minutes)
- Is SSL active and forced site-wide?
- Is there a firewall or malware scanner?
- What PHP version are you running? Anything unsupported is a real risk
- Is server-side or plugin-level caching in place?
7. Clean up (2 minutes)
- Remove demo content and unused themes — keep one default theme as a fallback
- Delete spam comments and old revisions
- Check that directory listing is disabled
- Confirm file permissions are sensible (644 for files, 755 for folders)
Ongoing routine
- Weekly — apply updates
- Monthly — review users and run a malware scan
- Quarterly — test a restore, review who has admin access
- Yearly — review hosting, PHP version and whether you still need every plugin
If you are already compromised
Change all passwords, restore from a clean backup taken before the infection, review users and scheduled tasks, then update everything. Ask your host to scan the account — infections often spread beyond WordPress itself.
