← Back to Blog

WordPress Security Checklist

Use a repeatable checklist to verify the security baseline and identify ownership gaps.

Veyra Admin

2 min read

  • Article
  • 2 minutes read
  • Reviewed August 4, 2026

A security checklist helps verify that important controls have an owner and a known state.

It does not replace a threat model, technical review or incident plan.

Software and Infrastructure

  • WordPress core is supported and updated.
  • Themes and plugins are maintained.
  • Unused software is removed.
  • PHP, database and server software are supported.
  • DNS and hosting accounts are protected.
  • TLS certificates renew reliably.
  • Staging and production are separated.
  • Deployment sources are controlled.

Accounts and Access

  • Every person has an individual account.
  • Privileged users use strong unique passwords.
  • 2FA is required for privileged accounts.
  • Roles follow least privilege.
  • Former users are removed.
  • Sessions and application passwords are reviewed.
  • Recovery email accounts are protected.
  • Database, hosting and SFTP credentials are restricted.

WordPress Configuration

  • HTTPS is used consistently.
  • wp-config.php is protected.
  • Security keys are unique.
  • Debug details are not displayed publicly.
  • File editing is disabled where appropriate.
  • File ownership and permissions follow the server architecture.
  • Public registration uses a low-privilege role.
  • Sensitive uploads are not publicly exposed.

Secure Development

  • State-changing actions check capabilities.
  • Nonces protect request intent.
  • Input is validated or sanitized.
  • Output is escaped by context.
  • SQL uses prepared queries.
  • REST routes define permission callbacks.
  • Uploads use allowlists, limits and controlled storage.
  • Secrets are not committed to public repositories.

Monitoring and Recovery

  • Backups include files and database.
  • Restore tests are completed.
  • Backups are protected from the production compromise.
  • Security events and errors are logged.
  • Alerts have owners.
  • File-integrity and malware checks are defined.
  • Incident contacts are available outside WordPress.
  • Credential rotation and clean deployment are documented.

Ongoing Review

Review the checklist after updates, staff changes, migrations, new plugins, integrations and incidents.

Record exceptions and a target date rather than marking an unknown control as complete.

Frequently Asked Questions

How often should the checklist be reviewed?

Use continuous monitoring and schedule a deeper review at a cadence appropriate to the site’s risk.

Does completing the checklist guarantee security?

No. It establishes a baseline and reveals gaps, but threats and systems continue to change.

Continue Learning

Previous: [What to Do When a WordPress Website Is Hacked](/resources/wordpress-manual/security/wordpress-hacked-response/)

Next section: [Performance](/resources/wordpress-manual/performance/)