WordPress security audit: complete step-by-step checklist

A WordPress security audit is not something you do after the site has already been hacked — it is something you do right before. It is the methodical review that tells you where you are vulnerable, how exposed you are, and what needs fixing, in what order. The good news is that you do not need a corporate budget, just a clear checklist and the discipline to follow it to the end.

Below you will find exactly that checklist, broken into steps you can follow even if you are not a developer. Each step looks at a different layer: who has access, what runs on the site, how you authenticate, and what happens if something slips through anyway.

What a WordPress security audit actually checks

A good audit covers three areas: the application (WordPress, themes and plugins), access (users, passwords, sessions) and infrastructure (hosting, backups, SSL certificate). Most attacks don’t come from a spectacular “hack”, but from an out-of-date plugin or a password reused from another account.

The point is not to tick everything off in a single day, but to have a clear map of what comes next. The diagram below sums up the main steps you go through in a complete audit.

Step 1: Who has access to the site

Start with people, because that is where the problem hides most often. Open the Users section in your WordPress dashboard and check every account.

• Delete old accounts belonging to collaborators who no longer work with you.
• Keep the number of administrators to a minimum — ideally one or two.
• If there is still a classic user named “admin”, rename it.
• Confirm that each person has exactly the role they need, and no more.

Step 2: What runs on the site

The second step checks all the code that executes: the WordPress core, the active theme and the plugins. A single plugin abandoned by its author, with a known vulnerability, can open the door to the entire site.

Go through your plugin list and uninstall the ones you no longer use — not just deactivated, but fully deleted, because the files stay on the server and can be exploited. Then make sure the core, theme and remaining plugins are updated to the latest version, and that unused themes have been removed.

Step 3: Passwords, authentication and sensitive files

This is where you reinforce the front door. Enforce long, unique passwords on all accounts, enable two-factor authentication (2FA) for administrators, and limit login attempts to block brute-force attacks.

• Check file permissions: 644 for files and 755 for directories.
• Protect or move the login page and hide the WordPress version from the source code.
• Disable file editing from the dashboard and turn off XML-RPC if you don’t use it.

If these steps start to sound technical, it is worth delegating the hardening to dedicated WordPress security services that get the configuration right the first time.

Step 4: Backup, monitoring and what comes after the audit

The last layer assumes that, despite every precaution, something can still go wrong. That is why you need an automated backup, stored off the server, and tested at least once with a real restore. A backup you have never restored is just an assumption.

Then add monitoring: periodic malware scans, alerts when files change, and an application firewall. The official recommendations in the WordPress hardening documentation are an excellent starting point for building your own plan. And if you want an impartial assessment of your current state, you can start with a free audit before investing in any service.

Conclusion

Security is not a button you press once — it is a routine you repeat. Work through this checklist now, note what you fixed and what remains, then schedule your next review three months out. Do this consistently and you turn your site from an easy target into one most automated attackers will simply skip. And the peace of mind of knowing exactly how protected you are is well worth the few hours invested.