The WordPress security checklist for small business owners

Most security checklists are forty items long and give equal weight to all of them. In practice the first four on this list prevent the overwhelming majority of compromises, and the rest are worth doing but will not save a site that ignores the first four.

Ordered by what actually matters.

The four that do most of the work

1. Update weekly

Time: 30 minutes a week. Skip it and you are running published vulnerabilities.

This is not a security tip, it is the security tip. Almost every hacked WordPress site was running a plugin with a flaw that had been patched months earlier. A security release is also an announcement — bots begin scanning for the unpatched version within days.

The procedure is here. Doing it badly and breaking your site is a real risk, which is why the checking step matters.

2. Delete what you do not use

Time: 30 minutes, once. Then whenever you deactivate something.

Deactivated is not removed. An inactive plugin is still code sitting on your server, still reachable, still exploitable. The same applies to themes — keep the one you use and one default fallback, delete the rest.

3. Strong, unique passwords with two-factor on every admin

Time: 20 minutes.

Credential stuffing — trying passwords leaked from other breaches — costs an attacker nothing. Two-factor kills it outright. Setting it up properly takes ten minutes.

While you are there: review who actually has an administrator account. It is usually more people than need one.

4. Off-site backups, tested

Time: 30 minutes to set up, 30 minutes a quarter to test.

This prevents nothing. It converts a disaster into an inconvenience, which is nearly as valuable. Off-site and tested are the two words that matter — a backup on the same server disappears with the server, and an untested one is a hope.

The next tier, genuinely worth doing

5. Keep PHP supported

An unsupported PHP version means no security fixes at the language level, and no amount of WordPress updating protects you from that. Your host changes it, usually in one click, usually free.

6. Turn off the file editor

One line in wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

Without it, anyone who gets into your admin can edit theme and plugin code directly in the browser — turning a stolen password into a permanent backdoor.

7. Watch for disclosed vulnerabilities

Knowing that something you run has a published flaw lets you act inside the window before exploitation. How to check is here, and our free plugin does it automatically.

8. Check for abandoned plugins

Anything not updated in over a year will never be fixed. This is a bigger risk than most people realise, and several widely-used plugins were removed from the directory this year after being compromised.

9. HTTPS, properly

Not just installed — enforced, with no mixed content warnings, and with the certificate renewal actually monitored. An expired certificate takes a site offline as effectively as a hack.

Worth doing, lower impact

10. Limit login attempts

Stops brute force noise and the resource drain that comes with it. Though it is not what stops a serious attack.

11. Security headers

X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Strict-Transport-Security. Cheap to add, invisible to visitors, and they block a whole class of browser-level attacks.

12. A firewall

Useful, and narrower than the marketing suggests. It buys you time against known attack patterns; it does not remove the need for items 1 to 4.

What is not on this list, deliberately

Hiding the login URL. Security by obscurity. It reduces bot noise in your logs and stops nothing that matters.

Changing the database table prefix. Marginal, and risky to do on an existing site.

Disabling XML-RPC entirely. Sometimes sensible, but it breaks the mobile app and some integrations. Restrict it rather than killing it.

Security plugins as a substitute for the above. They are tools, not a strategy — a scanner that alerts you to an outdated plugin is not the same as someone updating it.

The honest summary

Items 1 to 4 take about an hour to set up and thirty minutes a week to maintain, and between them they prevent nearly everything. They are also the ones that quietly stop happening, because nobody ever feels the benefit of a plugin updated on time.

If you want to know where your site stands against this list right now, our free plugin checks most of it and tells you in plain English, with no account. If you would rather someone else ran the weekly half, that is what the plans are.