WordPress Hardening Checklist for Small Businesses

Before you start

Take a full backup of the site, files and database, and confirm you can download it. Some of these steps change settings, and having a copy means any mistake can be undone. If you are uncomfortable with any step that touches the hosting account, ask your host or a developer to do it with you.

The checklist

1. Update everything

The WordPress guide says you should always keep up to date with the latest version of WordPress, and notes automatic updates have been available since version 3.7 ^[1]. Update your theme and plugins too. Plugin and theme automatic updates can be switched on per item from WordPress 5.5 onwards, but they are off by default ^[3]. The Australian Cyber Security Centre gives the same advice for every business system: turn on automatic updates for your devices and software ^[2].

2. Delete what you do not use

Deactivated plugins and old themes still sit on the server and can still contain weaknesses. The WordPress guide says to delete plugins you do not use ^[1]. Keep one default theme as a fallback and remove the rest.

3. Only install from trusted sources

Do not get plugins or themes from untrusted sources ^[1]. "Free" copies of paid plugins from unofficial sites can carry hidden code, and you have no way to check what was changed.

4. One person, one account

Shared logins make it impossible to know who changed what, and impossible to remove one person's access without disrupting everyone. Give each person their own account. The Australian Cyber Security Centre recommends that each user can access only what they need for their role ^[2], so editors should be editors, not administrators.

5. Strong, unique passwords

The WordPress guide advises long passwords mixing character types and avoiding names and dictionary words ^[1]. Use a password manager so every account has a different password. A reused password means one leak elsewhere can open your website too.

6. Two-step sign-in

The WordPress guide says it is a good idea to enable two-step authentication alongside a strong password ^[1], and the Australian Cyber Security Centre recommends turning on multi-factor authentication wherever possible, starting with your most important accounts ^[2]. Start with administrators, then the hosting account and the email account that receives password resets.

7. Backups stored away from the site

Back up your data regularly, including your databases, and protect the backups ^[1]. Make sure at least one copy lives outside your hosting account, and restore it on a test copy at least once. Our guide to backups that restore covers this in detail.

8. Review admin accounts

Once a quarter, list every administrator and remove anyone who no longer needs access, including former staff and developers who finished their work long ago.

9. File permissions

The guide recommends 755 for directories and 644 for files, and limiting which folders the web server can write to ^[1]. Your host's file manager usually shows permissions as numbers like these. If yours are 777 anywhere, ask your host to fix them.

10. Protect wp-config.php

This file holds your database password and security keys. The guide suggests permissions that let only you and the web server read it, generally 400 or 440, and denying web access to it on Apache servers through .htaccess ^[1].

11. Switch off dashboard file editing

WordPress includes an editor that lets administrators change theme and plugin code from the dashboard. If an attacker gains an admin login, it is a ready-made tool. Adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php removes it. The guide is honest that this will not stop an attacker uploading malicious files ^[1], but it removes an easy option.

12. HTTPS and logs

The guide recommends an encrypted HTTPS connection for administration ^[1]. Most hosts provide a free certificate. It also says logs are your best friend when it comes to understanding what is happening on a site, and recommends file integrity monitoring ^[1]. A security plugin that logs logins and file changes, with alerts going to a monitored inbox, covers the basics.

A ten-minute monthly routine

Once the checklist is done, most of the work is keeping it true. A short routine once a month covers the essentials:

1. Log in and apply any waiting updates, after confirming last night's backup ran.
2. Look at the Users screen and remove anyone who should no longer have access.
3. Check the plugin list for anything inactive that can be deleted.
4. Open Google Search Console and look at the Security Issues report.
5. Skim your security plugin's log for failed logins or file change alerts you do not recognise.

Put it in a calendar. Small, regular checks give you the best chance of catching problems while they are still easy to fix.

Do not forget the hosting account

Hardening WordPress does little if the hosting account above it is weak. Give the control panel its own strong password and two-step sign-in, remove old SFTP or FTP accounts, check which email address receives the host's security notices, and make sure the site runs on a PHP version the host still supports. These settings live outside WordPress, which is why they are easy to miss.

Common mistakes to avoid

• Installing several security plugins at once. They can conflict, slow the site and produce so many alerts that real ones get missed.
• Hiding the login page and calling it done. It reduces noise but does not replace strong passwords and two-step sign-in.
• Setting permissions so tight that updates fail, which leaves the site out of date.
• Keeping the only backups in the hosting account.

Deciding who does what

On a small business site, hardening often fails for a simple reason: everyone assumes someone else is doing it. The web designer thinks the host handles updates, the host thinks the owner does, and the owner thinks the designer is still looking after things. Writing down who is responsible for each part takes ten minutes and closes that gap.

Use a short table with three columns: the task, the person responsible, and how often it happens. Typical rows include:

• applying WordPress, plugin and theme updates, and checking the site afterwards;
• reviewing user accounts and removing people who have left;
• confirming backups ran and testing a restore now and then;
• renewing the domain name and the hosting account before they lapse;
• reading security notices from the host and acting on them.

Put a real name next to every task, even if that name is your own. Where an outside provider is responsible, note how you will know the work was done, such as a monthly report or an email after each update.

Keep the table with your other business records and look at it whenever staff or suppliers change. A checklist only protects the site if a person is actually working through it, and naming that person is the step that makes the rest of this guide happen.

Keeping it up

Hardening is not a one-off job. Plugins update, staff change and new weaknesses are found. A short monthly routine for updates and account checks, plus a full review every six months, keeps the work from undoing itself. If you would rather hand it over, our hardening service applies this checklist and our maintenance plans keep it current.