WordPress Security Checklist: Audit Your Own Site in About an Hour
A WordPress security check comes down to eight questions: who can log in, what is out of date, what is installed but unused, what is connected from outside, what is sitting in your files, whether your backups restore, whether your hosting is current, and whether anyone reads the alerts. You can check all eight yourself in about an hour with the list below. If you would rather have it done for you, a full WordPress security audit and setup is part of every one of our care plans.
The security problems we find when we take over a site are rarely clever. An old admin account still open, a plugin three years past its last update, a backup file sitting where anyone could download it. Nobody was checking.
We check these things on our clients’ sites every day. This checklist is the owner’s version: what you can look at yourself, what good looks like, and what to do when something is off.
What this checklist leaves out on purpose
These are checks, not the exact way we lock each site down. We keep that private, because a public step-by-step hardening recipe helps attackers as much as owners. On a call, we walk you through yours.
The checklist at a glance
| Check | Where to look | How often |
|---|---|---|
| 1. Who can log in | Users, filtered to Administrator | Monthly, and whenever someone leaves |
| 2. What is out of date | Dashboard > Updates, and each plugin’s WordPress.org page | Security fixes within a day; full check weekly |
| 3. What is unused | Plugins and Appearance > Themes | Quarterly |
| 4. What is connected | Plugin settings for remote dashboards and API keys | Quarterly, and after any security news |
| 5. What is in your files | Wordfence scan results, and your hosting file manager | Scan daily; look at the folders quarterly |
| 6. Backups restore | Your backup plugin and its storage | Check daily; test a restore quarterly |
| 7. Hosting is current | Tools > Site Health, and your hosting panel | Quarterly |
| 8. Alerts are read | Wherever Wordfence, Cloudflare and uptime alerts are sent | Every day |
1. Who can log in
Go to Users and click Administrator at the top to show only admins. Every name there can change anything on the site.
- Remove anyone who no longer needs access: past employees, old web designers, a developer from three years ago. Give people the lowest role that lets them do their job.
- Look for admins you do not recognize, especially generic names like “support” or “site tools”, or emails at domains you have never heard of. That is one of the clearest signs of a break-in.
- Turn on two-factor login for every admin. Wordfence includes it for free.
- Use a unique, long password for each admin, kept in a password manager, never shared between people.
An unfamiliar admin can come back after you delete it if something else on the site keeps recreating it. Our breach case study shows a real one and why the account had to go last.
2. What is out of date
- Check Dashboard > Updates. WordPress, plugins and themes should all be current. Security fixes need to go on within a day, because attackers start scanning for unpatched sites within hours of a fix coming out.
- Look at when each plugin was last updated. On each plugin’s WordPress.org page, a plugin with no update in two years or more may be abandoned, and nobody will fix its next hole.
- Watch for closed plugins. WordPress.org removes plugins with unfixed security problems. If a plugin you run has been closed, replace it.
Our guide to updating WordPress safely covers the order and the checks after.
3. What is installed but unused
A deactivated plugin is still a set of files on your server, and some security holes work even when the plugin is switched off.
- Delete plugins you are not using, rather than leaving them deactivated.
- Delete unused themes. Keep your active theme, its parent theme if it has one, and one default WordPress theme as a fallback.
- Watch for overlap. Two plugins doing the same job is double the code to keep safe.
4. What is connected from outside
Some plugins connect your site to an outside dashboard or service with a key, so you can manage it remotely. If that service is ever compromised, the key becomes a way in that skips your login entirely.
- Go through your plugins’ settings for remote dashboards, cloud connections and API keys.
- Disconnect anything you do not use or do not remember setting up. Some plugins tick the box to connect during setup by default.
- Remove old management connections from agencies or tools you no longer use.
The keys nobody knew about
On October 18 and 19, 2026, attackers used stolen keys from one backup plugin’s cloud dashboard to install a fake plugin on connected sites. It created a hidden admin account. No update could stop it, because the attack came in through a legitimate connection, not a bug. The only fix was removing the connection key from each site.
That backup plugin runs on almost every site we look after, and many sites carried a key their owners never knowingly created, because the setup box to connect was ticked by default. We checked every site for signs of the fake plugin and found none. Then we removed every one of those keys across the 105+ sites we look after, and verified each one was gone. It is why “what is connected” is on this list.
5. What is sitting in your files
- Make sure a malware scan actually runs. In Wordfence, check the date of the last completed scan. A scanner that stopped running months ago protects nothing.
- Read what the scan flags, especially unknown files inside WordPress’s own folders. WordPress core never needs extra files there.
- Look for leftovers in your hosting file manager: old copies of the site, folders from a previous website, and backup or export files. Backups left in a web folder can sometimes be downloaded by anyone who guesses the name.
On one site we took over, a routine backup check flagged a 743 MB file in the website’s folder that anyone could download. Looking further, we found leftover files from the site’s pre-WordPress days, including a tiny backdoor file dated 2014. It had been sitting there for over a decade. We quarantined everything and blocked scripts from running in those folders.
6. Whether your backups restore
- Backups run on a schedule and the latest one finished without errors.
- Copies are stored off the server, in cloud storage, not just on the same hosting account that could be hacked or lost.
- A restore has actually been tested. A backup you have never restored is a hope, not a plan.
Our guide to backing up a WordPress site covers the setup we use.
7. Whether your hosting is current
- PHP version: check Tools > Site Health > Info > Server. Versions that no longer get security fixes leave holes no plugin can close. See how to update PHP on WordPress.
- HTTPS: the site should load with a padlock on every page, with no browser warnings. See why a site says “Not Secure”.
- Sites sharing one hosting account: if several websites live under one hosting login, a hack of one can reach the others. We found three sites sharing one account and one server user, so a break-in on any one of them could reach all three.
- Logins to the hosting itself: the hosting account, file access and database logins should use strong unique passwords and two-factor login where offered.
Rather have this checked for you, every day?
Security runs on every one of our care plans, from $119 a month.
- Talk to a WordPress expertWe look at your plugins, logins and hosting with you.
- We back up, then lock it downFirewall, scanning, hardening and monitoring set up within 24 hours.
- We watch it every dayUpdates, scans and alerts checked by a person, not left to run on their own.
8. Whether anyone reads the alerts
Security tools only help if a person acts on what they send. A warning sitting in an unread inbox protects nothing.
- Find out where alerts go: Wordfence, Cloudflare, your uptime monitor and your host all send email. Make sure it goes to an address someone reads every day.
- Put Cloudflare in front of the site to block attacks before they reach your server, with Wordfence on the site itself. Each catches things the other misses.
- Know who acts. If an alert comes in on a Saturday, who looks at it, and what do they do?
When security news breaks, act on it quickly. When a popular SEO plugin’s paid version was briefly shipped with a backdoor in October 2026, what decided whether a site was affected was when the plugin had been installed or updated, not just its version. We checked the install and update times on every site we look after that runs it. None had updated during the bad window.
Want a quick read before you start? Our free Uh Oh Score checks your site and shows what to fix first, with no sales call required.
Get my Uh Oh ScoreQuestions people ask
How do I do a security audit of a WordPress website?
Check eight things: admin users, updates, unused plugins and themes, outside connections, files and malware scans, backups, hosting and PHP version, and who reads the alerts. The checklist above shows where to look for each.
How often should I check my WordPress site’s security?
Alerts and malware scans every day, updates within a day for security fixes, users monthly, and the full checklist every quarter.
Is a security plugin enough?
No. A plugin like Wordfence is one layer. You also need updates on time, Cloudflare in front of the site, working backups and someone who reads the alerts.
Should I delete deactivated plugins?
Yes. Deactivated plugins are still files on your server, and some security holes work even when a plugin is switched off.
How do I know if my WordPress site has been hacked?
Common signs: admin users you do not recognize, plugins you did not install, unexpected redirects or spam pages, and malware scan warnings. If you see any of these, get help before deleting things, because some backdoors recreate what you remove.
What does a WordPress security audit cost?
On our care plans, a security review is part of setup and hardening is reviewed every month, from $119 a month. If you need a one-time audit before choosing a plan, ask us on a call.
Why don’t you publish your full hardening steps?
Because a public, detailed recipe for how a site is locked down helps attackers as much as owners. This checklist covers what owners can verify; the exact setup for each site stays private.
Sources
- WordPress Developer Resources, Hardening WordPress.
- WordPress Developer Resources, WordPress backups.
- Wordfence, Wordfence help documentation.
- Cloudflare, Web Application Firewall documentation.
Stop wondering if your site is safe
We check your users, updates, files, backups and alerts every day, and act on them, so a warning never sits in an inbox.
Jonathan Wofford is the founder of Your WP Guy, a WordPress care and maintenance service supporting 105+ active client sites. He and his team keep WordPress sites fast, secure, and running, so business owners can stay focused on their business instead of their website.
