The vast majority of WordPress hacks are not aimed at any particular site: bots constantly probe millions of websites looking for a vulnerable plugin or a weak password. Securing a WordPress site is therefore, first and foremost, about no longer being an easy target. Here is the 12-point checklist I use in my audits, from the simplest items to the most technical.
The basics: versions and plugins
1. Update the core, themes and plugins
Most exploited vulnerabilities have already been fixed by the vendor: it is the missing update that opens the door. On an e-commerce site, test updates on a copy before applying them to the live site.
2. Remove what you do not use
A deactivated plugin is still on the server and can still be exploited. Delete it, along with any unused themes (keep a single default theme as a fallback).
3. Only install from official sources
The WordPress.org directory or the vendor’s own website, nothing else. “Nulled” copies of premium plugins, handed out for free, very often contain a backdoor.
4. Choose maintained plugins
Before installing a plugin, check when it was last updated, how many active installations it has and how responsive its support is. An abandoned plugin will not get a fix on the day a vulnerability is discovered.
Access: accounts and logins
5. Long, unique passwords
Every administrator account needs a long, unique password stored in a password manager. Avoid the “admin” username and shared accounts: one account per person, so you know who did what.
6. Two-factor authentication
Enable two-factor authentication (a code generated by an app) at least for administrators and editors. It is the measure that best neutralises a stolen password.
7. Least privilege and login limits
Give each user only the role they actually need: an author does not need to be an administrator. Limit login attempts and, if you use neither the mobile app nor a remote publishing tool, disable XML-RPC, a frequent target of brute-force attacks.
The server and the files
8. HTTPS across the whole site
A TLS certificate, free with most hosts thanks to Let’s Encrypt, encrypts traffic, starting with login credentials. Force the redirect from HTTP to HTTPS on every page.
9. Disable the file editor
Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php. An attacker who managed to gain administrator access would then be unable to edit theme and plugin code from the dashboard.
10. Protect wp-config.php and the uploads folder
Apply strict file permissions (usually 644 for files and 755 for folders, tighter for wp-config.php), block PHP execution in wp-content/uploads/ and turn off directory listing. These settings are made at server level and depend on your hosting.
11. A supported PHP version
A PHP version that no longer receives security fixes exposes the whole server. Check which version you run under Tools > Site Health and move to an actively supported version, after testing your site’s compatibility.
The safety net
12. Off-site backups and monitoring
Automatic backups, stored somewhere other than your host, kept for several days and tested: a backup you have never restored is only a hypothesis. Add uptime monitoring, Google Search Console security alerts and, where possible, a web application firewall (WAF) provided by your host or a specialist service.
Do you need a plugin to secure WordPress?
A security plugin can make several items on this list easier (login limits, two-factor authentication, file scanning), but it replaces neither updates nor proper server settings. Avoid stacking several of them: they get in each other’s way and slow the site down. One, properly configured, is enough.
Want to know how your site scores on these 12 points? The express audit (€290 excl. VAT, 30,000 DZD in Algeria) checks security, versions and performance and gives you 10 priority actions. To apply updates without risk, the secure WordPress update costs €190 excl. VAT (20,000 DZD).