Most WordPress compromises are predictable: outdated plugins, weak logins, and no backups. Hosting matters, but process matters more. This checklist focuses on steps that reduce risk without turning your site into a maintenance nightmare.
Foundation: the minimum you should do
- Use a unique admin username and a password manager.
- Enable 2FA for admin accounts if possible.
- Keep WordPress core, theme, and plugins updated.
- Remove plugins you do not use.
Hosting features worth paying attention to
- Automated backups with easy restore (and keep an extra copy off-host).
- WAF or basic firewall features (even simple rules help).
- Staging environment for safe updates.
- Server-side caching and HTTP/2 or HTTP/3 support.
Least privilege: reduce the blast radius
Give each user the lowest role needed. Separate admin from editor accounts. Use SSH keys if you manage servers yourself, and avoid shared logins.
Practical update routine
- Take a backup.
- Update plugins first, then themes, then core.
- Check your key pages and checkout flows.
- Monitor logs for weird login attempts.
