WordPress Security Checklist for Business Sites (2026)

Most hacked WordPress sites aren’t targeted. They’re found by automated bots scanning millions of sites for one outdated plugin, one weak password, one missing update. The entire checklist that prevents the vast majority of hacks fits on one page: update everything, use two-factor authentication, limit who has admin access, run a firewall, and keep tested off-site backups. Do those five and you’re safer than roughly 90% of WordPress sites on the internet.

I clean up hacked WordPress sites for clients, and I can tell you the pattern from the other side of it. Nobody in that situation was running some exotic configuration. They were running a normal business site, they had not updated in six months, the admin password was the business name plus 123, and there were four admin accounts belonging to people who stopped working on the site years ago. Every one of those hacks was preventable, and none of the prevention was complicated. That’s what this checklist is: the unglamorous basics, in the order that matters.

Why business sites get hacked (it’s not personal)

Almost nobody gets hacked because someone chose them. The overwhelming majority of WordPress compromises are automated: botnets probe every site they can find for known vulnerabilities in outdated plugins and themes, then try lists of common passwords against wp-login.php. Your five-page brochure site gets the same attention as everyone else’s, because the bots don’t discriminate. They can’t. There are too many sites and too few humans.

This is actually good news. It means you don’t need to outrun a dedicated attacker. You need to not be the easy target in an automated sweep. The bots move on from sites that are patched, locked down, and backed up, because there are millions of softer targets behind you.

The single biggest entry point, by a wide margin, is outdated plugins and themes with known vulnerabilities. Not zero-days. Not sophisticated exploits. Known holes with published patches that the site owner never applied. Everything on this checklist exists to close that gap and the handful of others that matter.

The checklist: updates and hygiene

1. Update core, plugins, and themes promptly

This is item one because it stops the most hacks. Enable automatic updates for minor WordPress core releases, and update plugins and themes within days of a release, not months. Before updating a business site, take a backup (item 11) so you can roll back if an update breaks something. Fear of breaking the site is the number one reason updates don’t happen, and the backup is what removes that fear.

2. Delete what you do not use

Every installed plugin and theme is attack surface, including inactive ones. Inactive doesn’t mean harmless: vulnerable code sitting on the server can still be reached directly in many configurations. If you’re not using it, delete it. Most business sites I audit are carrying five to ten plugins they installed once for a single feature and forgot. Go through the list twice a year.

3. Run a supported PHP version

Old PHP versions stop receiving security patches, and hosts don’t always move you forward on their own. Check under Tools → Site Health in your dashboard. If you’re on anything below 8.1 in 2026, ask your host to move you. This is a five-minute change with your host and it closes a whole class of server-level issues. For more on the performance side of this, see my guide on why WordPress sites load slowly.

4. Use a host that takes security seriously

Shared hosting where one compromised neighbour can read your files is a security problem no plugin can fully fix. You don’t need expensive hosting, but you do need account isolation, server-level firewalls, and malware scanning. If your host can’t tell you what they do about these three things, that’s your answer. I break down what hosting should cost and what the tiers actually buy you in how much a WordPress website costs.

The checklist: access control

5. Two-factor authentication on every admin account

Passwords leak. They get reused across sites, phished, and guessed. Two-factor authentication means a stolen password alone isn’t enough, and it’s the single highest-value five minutes you’ll spend on this list. Use an authenticator app rather than SMS codes. Every administrator account gets it, not just yours.

6. Give people the lowest role they need, and remove the rest

Audit your Users list right now. You’ll likely find admin accounts for a developer from three years ago, an agency you no longer use, and a staff member who left. Every admin account is a full set of keys to the site. Delete accounts that should not be there, and give editors the Editor role instead of Administrator. When a working relationship ends, remove the account the same day. I’ve cleaned up hacks that entered through a former contractor’s credentials more than once.

7. Limit login attempts

WordPress lets anyone try passwords forever by default, which is exactly what brute-force bots rely on. Any reputable security plugin (item 13) does this out of the box. One honest note: renaming wp-login.php or hiding the login page is often sold as security, but it’s obscurity, not protection. Bots find the new URL quickly. Do it if you like, but don’t count it as a layer.

The checklist: protection layers

8. HTTPS everywhere

Non-negotiable in 2026, and free through Let’s Encrypt with almost every host. Beyond the padlock, HTTPS protects your admin logins from being intercepted on shared networks. If any part of your site still loads over HTTP, fix the mixed content rather than ignoring the warning.

9. Put a firewall in front of the site

A web application firewall filters malicious requests before they reach WordPress. The free Cloudflare tier blocks a remarkable amount of automated attack traffic and takes about twenty minutes to set up. That alone is enough for most brochure sites. Higher-risk sites, particularly stores, should consider a dedicated WordPress firewall such as Sucuri. This is the layer that quietly absorbs the thousands of probes your site receives weekly.

10. Harden the configuration

Three small changes, each taking a minute: disable file editing from the dashboard by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php, so a compromised admin session cannot install malware through the editor; make sure wp-config.php itself isn’t web-accessible (it shouldn’t be, but verify); and disable XML-RPC if you don’t use the WordPress mobile app or Jetpack features that depend on it. These are set-and-forget.

The checklist: your safety net

11. Automated daily backups, stored off-site, with tested restores

Backups don’t prevent hacks. They determine whether a hack costs you an afternoon or a business. Three requirements, all commonly missed: automated (manual backups don’t happen), stored somewhere other than your hosting account (if the server goes, your backups go with it), and restore-tested at least once (a backup you’ve never restored is a hope, not a plan). UpdraftPlus to remote storage covers this for most sites. Keep at least 30 days of history.

12. Monitor uptime and file integrity

You want to know about a problem in minutes, not when a customer tells you next month. Uptime monitoring is free and takes minutes to set up. File integrity monitoring, included in plugins like Wordfence, alerts you when core files change unexpectedly, which is often the first sign of a compromise. Scan the site externally every few months with a free scanner to catch what internal tools miss.

13. Run one good security plugin, configured properly

Wordfence and Sucuri are the two serious options, and the honest comparison is this: Wordfence’s free tier is excellent and enough for most sites if you actually configure it (firewall in extended protection mode, login limits on, scans scheduled). Sucuri’s paid plans buy you their incident response team, which is worth it if downtime costs you real money. What doesn’t work is installing either one and never opening its settings. A default install with everything off is decoration.

What to do if you are already hacked

If you’re reading this section in a panic, do these in order:

1. Don’t just delete the suspicious files. Modern malware reinfects from hidden backdoors. Deleting what you can see wastes the afternoon.
2. Put the site in maintenance mode so visitors, and Google, stop seeing the hacked version.
3. Restore from a clean backup from before the hack, if you have one. This resolves most cases in under an hour, which is the entire point of item 11.
4. No clean backup? This is now a professional cleanup job: hire it out (Sucuri and Wordfence both offer it) rather than spending three days learning malware forensics.
5. After cleanup, close the hole: update everything, change ALL passwords (hosting, WordPress, database, FTP), regenerate WordPress salts, and remove unknown admin accounts. Most reinfections happen because the entry point was never closed.
6. Request a Google review in Search Console if the site was flagged, after you’re certain it’s clean.

What security actually costs

Approach	Cost	What you get
DIY basics	$0	Updates, 2FA, Cloudflare free, Wordfence free, UpdraftPlus free to remote storage. Covers the checklist above.
DIY plus premium	$100 to $300/year	Sucuri or Wordfence premium, premium backups. Adds incident response and support.
Care plan	$30 to $250/month	Someone else does updates, monitoring, and cleanup. See my maintenance checklist for what a good plan includes.
Post-hack cleanup	$200 to $500 one-time	Professional malware removal. The most expensive way to buy security, after the fact.

Notice the pattern: the free tier covers nearly everything that matters. What money buys is response time and someone else’s attention, not fundamentally better protection. For the full picture of where security sits in a site budget, see WordPress website costs in 2026.

Frequently Asked Questions (FAQ)