Break-ins on small WordPress sites often trace back to ordinary gaps rather than clever attacks: an old plugin, an admin password shared with former contractors, or no backup from before the problem started. This WordPress security checklist is for business sites: brochure sites, lead-generation sites and small WooCommerce stores where nobody’s full-time job is security. It draws on WordPress’s own hardening guide and was checked against the current release in October 2026.
1. Keep WordPress, plugins and themes current
WordPress’s hardening guide is blunt: older versions don’t get security fixes, so stay on the latest release. At the time of writing that is WordPress 7.1.3, released on 6 October 2026, according to the official release archive. The same day also brought point releases for many older branches, a reminder that security fixes keep coming even for versions you might think of as settled.
Core applies minor updates automatically by default, and since WordPress 5.5 you can switch on automatic updates for each plugin and theme from the admin screens. For a simple site, turn them on for well-maintained plugins and check the site after each round. For a store or a site with custom code, test updates on a staging copy first.
Check your server too. WordPress’s requirements page recommends PHP 8.3 or newer and MySQL 8.0 or MariaDB 10.11 or newer, and warns that older versions which still run are end-of-life and may leave you exposed.
2. Tighten logins
- Give every person their own account, with the lowest role that lets them do their job. Editors rarely need to be administrators.
- Use long, unique passwords from a password manager. The hardening guide warns against passwords based on names, usernames or dictionary words.
- Turn on two-step authentication for every administrator. WordPress core doesn’t include it, so use a well-maintained plugin or your host’s login protection.
- Remove accounts for staff, agencies and freelancers who have left. Do this on the day the work ends.
- Avoid “admin” as a username. The guide notes that this, like changing the database table prefix, helps only a little by itself.
3. Lock down files and configuration
The hardening guide recommends file permissions of 755 for directories and 644 for files, with wp-config.php restricted further (around 400 or 440). Add this line to wp-config.php to remove the dashboard’s built-in theme and plugin code editor:
define( ‘DISALLOW_FILE_EDIT’, true );
It stops someone who gets into an admin account from editing PHP through the browser, though, as the guide points out, it doesn’t stop malicious uploads. Give each site its own database user, and serve the whole site, including the admin area, over HTTPS.
- Update weekly, test big releases on staging
- Two-step login for every admin
- Dated, off-site backups you have restored
- Delete plugins you don’t use
- Shared admin logins
- Nulled or pirated premium plugins
- Backups stored only on the same server
- Running PHP versions past end-of-life
4. Be strict about plugins and themes
Install plugins and themes only from WordPress.org or well-known vendors, as the hardening guide advises, and never from sites offering free copies of paid products. Those “nulled” copies can arrive with malware hidden inside. Keep everything updated and delete what you don’t use: a deactivated plugin is still code on your server.
Before installing a new plugin, look at when it was last updated, whether it supports your WordPress version and how the developer responds to support questions. Fewer plugins means fewer things to patch.
Write down who is responsible for updates. On many small business sites the answer is “the agency that built it”, and nobody has checked whether the agency still looks.
5. Back up as if you will need it next week
WordPress’s guidance is to back up regularly, including the database, keep several dated snapshots in a trusted location, and protect their integrity. In practice: automatic daily backups for sites that change often, stored somewhere other than the web server, with at least 30 days of history so you can go back to before a quiet infection began. Then restore one to a test location every few months. A backup you have never restored is an assumption.
6. Monitoring: the last item on a WordPress security checklist
Keep your server’s access and error logs, and use a tool that alerts you when files change. The hardening guide mentions options from file-change monitoring with tools like Git to WordPress security plugins and firewalls in front of the site. A web application firewall from your host or a proxy service filters a lot of junk traffic before it reaches WordPress. Set up uptime alerts as well, so you hear about a defaced or broken site before a customer tells you.
If you want a site reviewed or rebuilt with security in mind from the start, our website team can help, and our technology advice covers who should own updates and access in a small business.
Frequently asked questions
Is WordPress secure enough for a business website?
Yes, when it is maintained. WordPress core receives regular security releases, and the WordPress project publishes hardening guidance. The common weak points are outdated plugins, weak or shared passwords and missing backups, rather than core itself. A business site with current software, two-step logins, a short plugin list and tested backups is in a strong position.
Do I need a WordPress security plugin?
Not always, but one can help. Security plugins typically add login protection, file-change alerts and firewall rules. If your host already provides a firewall, malware scanning and backups, a plugin may duplicate that work. Choose one well-maintained option rather than stacking several, because overlapping security plugins can conflict with each other and slow the site.
How often should I update WordPress plugins?
Check for updates at least weekly and apply security fixes promptly. Many sites can use automatic updates for well-maintained plugins, available since WordPress 5.5. For online stores or sites with custom code, test major updates on a staging copy first. Whoever is responsible should note what was updated, so problems can be traced quickly.