A WordPress security checklist should cover access, updates, recovery and alerts, with a named owner and evidence for each check. A green plugin dashboard alone cannot establish that a business website is secure. Start with the controls below, then turn unknown answers into specific follow-up work.

I would rather see an honest “not verified” beside a control than a confident tick with no supporting record. This guide helps owners review their setup with a provider. It does not certify security or replace an incident investigation.

Start your WordPress security checklist with access

First, list who can reach WordPress, hosting, your domain registrar and the business email used for account recovery. Confirm that the business controls those accounts. Keep passwords and recovery codes in an approved password manager, outside this worksheet.

Next, ask which people still need access and what work each person performs. The WordPress roles documentation explains the different capabilities. Someone publishing articles may not need administrator access. However, custom roles and plugins can change permissions, so have the responsible administrator verify the actual setup.

Use individual accounts where supported. Arrange an access review when someone leaves or changes responsibilities. Before removing an account, confirm content ownership and the supported handover process. Avoid deleting an unfamiliar account blindly; ask who created it and preserve evidence if compromise is suspected.

Check authentication and recovery together

Use strong, unique passwords and enable supported two-factor authentication, especially for privileged accounts. The official WordPress hardening guide recommends strong passwords and an additional authentication step. It also describes security as reducing risk, rather than eliminating it.

Then check the recovery route. Who can restore access if the administrator loses a phone? Where are recovery instructions held? Do not place secret codes in a shared report. Instead, record that an authorized person verified the approved recovery method.

Also verify unexpected requests for credentials through an established contact route. A message that names your website or provider is not sufficient proof of identity. Stop and confirm the request before sharing access.

Keep software supported and changes accountable

Review WordPress core, themes, plugins and the hosting software your provider manages. Record available security fixes, supported versions and the person handling them. Ask for a response based on the actual vulnerability; a monthly calendar should not automatically delay an urgent patch.

The Wordfence security checklist distinguishes practical automatic updates from changes that need testing. Choose an update approach suited to the site, with a recovery plan and checks afterward. Our safe plugin-update guide covers that workflow in detail.

In addition, review unused extensions and old test installations with your maintainer. Confirm dependencies before removal. Obtain software from trusted sources. Do not install several overlapping security tools simply to make this list longer; first establish what your host and existing tools already cover.

Make recovery and alerts part of the review

The WordPress backup documentation separates website files from the database. Confirm the scope, time and access route for the copies your business would need. Next, request evidence of a safe restore rehearsal. A completed backup job and a tested recovery are different findings.

Use our restore-test record for that separate task. Here, record the latest result and any unresolved limitation. For example, a recovered homepage does not establish that checkout or inquiry delivery works.

Finally, identify who receives security alerts and who acts on them. Ask the provider what scanning, firewall and logging coverage exists, including its limits. A clean scan is a result for that check at that time. It is not proof that no compromise exists anywhere.

Use this WordPress security checklist evidence sheet

Copy the following structure into a private maintenance note. Choose one status for each row: verified, action needed, not verified, or not applicable with a reason. Keep sensitive account details and raw logs out of broadly shared copies.

For every unresolved row, add the next action, responsible person and review date. Also record the website, review time and time zone, evidence location and any dependency. An authorized colleague or AI agent can then follow the record without guessing what a tick means.

Fictional example: the provider confirms two-factor authentication for the owner account, but a former contractor’s access has not been reviewed. Mark authentication verified for the checked account only. Mark access review as action needed, assign it and request confirmation afterward. Do not label every account protected.

Turn findings into a clear next step

If you notice an unknown administrator, unexpected redirect or browser warning, contact your host or security specialist promptly. Preserve the time, affected address and non-sensitive evidence. Avoid random deletion or restoration that could destroy useful information or newer business records.

For routine work, combine this WordPress security checklist with our broader maintenance checklist. Keep the security evidence focused on controls and unresolved risks, rather than repeating every housekeeping task.

At OhTurbo!, I want owners to have a clear next step instead of an unexplained report. Our website care plan includes unlimited monthly edits without hourly caps, with month-to-month flexibility. Ask how ongoing care fits your website’s needs, and request a free website review.