WordPress Security Checklist for Small Businesses (2026)

If your business runs on WordPress, you're in good company. WordPress powers a huge share of the web. That popularity also makes it the most targeted website platform there is.

The good news is that most WordPress hacks aren't sophisticated. They take advantage of the same handful of gaps, over and over. Close those gaps and your site becomes a much harder target than the millions that leave them open.

This is the checklist we use on every client site at Silver Path Marketing, with the steps to do each one yourself.

Why WordPress sites get hacked

WordPress itself is rarely the problem. The plugins and themes you add to it are.

According to Patchstack's vulnerability database, about 92% of known WordPress vulnerabilities are in plugins, 8% are in themes, and less than 1% are in WordPress core. Their State of WordPress Security in 2026 report adds a few numbers every business owner should know:

• 11,334 new vulnerabilities were found in 2025, up 42% from the year before.
• For the most-attacked vulnerabilities, the typical time from public disclosure to mass attacks was about 5 hours.
• 46% of vulnerabilities had no fix available from the developer when they were made public.
• Paid and premium plugins had three times as many actively exploited vulnerabilities as free ones. Paying for a plugin doesn't make it safer.

The most common types are cross-site scripting (an attacker plants code that runs in a visitor's or admin's browser), broken access control (a plugin lets the wrong person do admin-level things), cross-site request forgery, and SQL injection. You don't need to know how each one works. You just need to keep the doors closed.

What's riskiest to leave out of date?

If you only have time for one thing, update your plugins. Here's how the four layers of a WordPress site rank:

1. Plugins (highest risk). Almost every vulnerability lives here, most sites run 15 to 40 of them, and attackers move within hours.
2. Your theme (moderate). Fewer vulnerabilities, but big page-builder themes bundle a lot of code. Many automatic update tools skip themes, so they're easy to forget.
3. PHP (low day to day, serious once it's unsupported). PHP is the language WordPress runs on. Once a version reaches end of life, it gets no more security fixes. Check the official PHP supported versions page. As of this writing, PHP 8.1 and older are no longer supported and PHP 8.2 stops getting security fixes on December 31, 2026.
4. WordPress core (lowest). Core has very few vulnerabilities, and WordPress installs minor security releases automatically on most hosts.

The 10-step WordPress security checklist

1. Turn on two-factor authentication for every admin

Stolen and reused passwords are the easiest way into a website. Two-factor authentication (2FA) means a password alone isn't enough to log in.

How to do it:

1. Install a security plugin that includes 2FA, such as Wordfence (its Login Security section).
2. Have each Administrator and Editor scan the QR code with an authenticator app like Google Authenticator, Microsoft Authenticator, or 1Password.
3. Save the recovery codes somewhere safe, like a password manager.
4. Require 2FA for the Administrator and Editor roles so no one can skip it.

2. Give everyone their own login, and as little access as they need

Shared logins make it impossible to know who did what. Old accounts for past employees, freelancers, or agencies are open doors.

How to do it:

1. Go to Users in your WordPress dashboard.
2. Delete or downgrade any account that doesn't belong to a current person. When you delete one, WordPress lets you reassign that person's content to another user.
3. Keep the Administrator role for the one or two people who truly need it. Give content writers the Editor or Author role.
4. Repeat this review every quarter, and any time someone leaves.

3. Update plugins weekly, with a backup first

Because attacks start within hours of a vulnerability going public, updates are your most important habit.

How to do it:

1. Take a backup first (see step 7).
2. Go to Dashboard > Updates and update your plugins.
3. Check your homepage, your top landing pages, and your contact or quote forms. Submit a test form to make sure leads still arrive.
4. If something breaks, restore the backup and update that plugin on its own to find the culprit.
5. For premium plugins, make sure your license key is entered and current. An expired license quietly stops updates.

Many managed WordPress hosts now offer automatic plugin updates with visual testing and rollback. These are worth considering, but they usually skip themes and don't test your forms, so keep a human check in the loop.

4. Delete plugins and themes you don't use

A deactivated plugin can still be exploited. If you're not using it, it shouldn't be on the server.

How to do it:

1. Go to Plugins, filter by Inactive, and delete anything you don't need.
2. Look for leftovers from an old host or an old project, like hosting control panel plugins or duplicate backup plugins.
3. Go to Appearance > Themes and delete every theme except your active theme and its parent theme.

5. Add a firewall that blocks known attacks

Since nearly half of vulnerabilities have no fix when they go public, updates alone can't protect you. A web application firewall (WAF) with "virtual patching" blocks known attacks before you've had a chance to update.

How to do it:

1. Choose one firewall: Wordfence, Patchstack, or your host's built-in option. Running two often causes conflicts.
2. Turn on malware scanning and email alerts.
3. If your host runs automatic updates, allowlist its IP addresses in the firewall so updates aren't blocked.

6. Lock down the easy targets

A few small settings remove common attack paths. The official WordPress hardening guide covers these in more depth.

How to do it:

• Turn off the file editor. Add define( 'DISALLOW_FILE_EDIT', true ); to your wp-config.php file, or use the toggle in your security plugin. This stops anyone who gets into your dashboard from editing your theme or plugin code.
• Turn off XML-RPC unless you use the WordPress mobile app or Jetpack. It's a common target for password-guessing attacks. Most security plugins have a one-click setting for it.
• Limit login attempts so bots can't guess passwords endlessly. Many hosts do this for you. If yours doesn't, your security plugin can.

What about changing your login URL? Moving the login page from /wp-admin to a custom address cuts down on bot traffic and clutter in your logs. It's fine to do, but it isn't real protection. Most attacks go after plugin vulnerabilities and never touch the login page. Treat it as a nice-to-have, never a replacement for 2FA and updates.

7. Keep backups you control

Backups are your undo button. Most quality hosts take nightly backups, but they usually keep them for only 30 days, and they live inside the same account an attacker might get into.

How to do it:

1. Confirm your host takes nightly backups and check how long it keeps them.
2. Take a manual backup before every update or major change.
3. Once a month, download a full backup and store it somewhere separate, like a shared Google Drive folder.
4. Once a year, practice restoring a backup to a staging site so you know the process works.

8. Log admin activity

An activity log records who changed what, and when. It's the best early warning you can have. A new admin account you didn't create, or a plugin nobody remembers installing, is often the first sign of a break-in.

How to do it:

1. Install one activity log plugin, such as WP Activity Log or Simple History.
2. Set up instant email alerts for the high-risk events: new users, role changes to Administrator, plugin or theme installs, and changes to core settings like the site URL or admin email.
3. Keep 90 to 180 days of history so the log doesn't bloat your database.
4. If your plugin supports it, send a copy of the log somewhere outside the site. Anyone who gets admin access can erase a log stored on the site itself.
5. Skim the log once a month for unfamiliar users, odd login times, and changes no one on your team made.

9. Protect your domain and your email

Your domain registrar and DNS accounts are even more valuable than your website. Whoever controls them controls where your site and your email go.

How to do it:

1. Turn on 2FA at your domain registrar (GoDaddy, Namecheap, Google, and so on) and at your DNS provider if it's separate, such as Cloudflare.
2. Turn on the registrar lock (sometimes called transfer lock) for your domain.
3. Set up SPF, DKIM, and DMARC records for your domain so scammers can't easily send email pretending to be you. Your email provider has setup instructions for each.
4. Send your website's form notifications through an authenticated email service (SMTP) so they don't land in spam.

10. Protect your forms and watch your uptime

Contact and quote forms are where your leads come in, and they're a favorite target for spam bots.

How to do it:

1. Add spam protection to every public form. Google reCAPTCHA works, and Cloudflare Turnstile is a free, more privacy-friendly option.
2. Set up uptime monitoring so you get an alert if your site goes down, instead of finding out from a customer.

How often to do what

• Once, when you set up the site: 2FA, user cleanup, firewall, file editor and XML-RPC settings, activity logging, form protection, domain and email security.
• Weekly: backup, plugin updates, and a quick test of your forms and key pages.
• Monthly: theme updates, a downloaded backup stored off-site, and a skim of the activity log.
• Quarterly: review users and delete unused plugins and themes.
• Twice a year: check that your PHP version is still supported.

Want help keeping your site secure?

Security works best as a routine, not a one-time project. If you'd rather spend your time running your business, we're happy to help. Silver Path Marketing handles WordPress maintenance for small and mid-size businesses: weekly backups, updates, and testing, so your site keeps bringing in leads.

Book a free call and we'll take a look at your site together.