Most WordPress sites that get hacked are not targeted by anyone in particular. They are found by automated scripts that crawl the web looking for an old plugin, a weak password or a forgotten admin account. That is good news, because it means a sensible WordPress security checklist stops the vast majority of attacks before they start. You do not need to be a developer to follow it, and most of the steps take less than ten minutes.

What follows is the routine I recommend to anyone running a blog, a small shop or a business site on WordPress. Work through it once, then revisit it every few months.

Start with updates, because they fix most problems

WordPress powers a huge share of the web, which is exactly why it attracts so much automated probing. The core software itself is reviewed by a large community and patched quickly. The weak points are usually plugins and themes that have not been updated in months.

Turn on automatic updates for minor core releases and for plugins you trust. For anything that could break your layout, such as a page builder or a heavily customised theme, update manually but do it weekly. While you are in the Plugins screen, delete anything you are not using. A deactivated plugin still sits on the server, and if it contains a vulnerability it can still be exploited.

Lock down logins and user accounts

The login page is the front door, and bots knock on it thousands of times a day. Three habits make a dramatic difference.

First, use long, unique passwords for every account, stored in a password manager. Second, never use "admin" as a username, and check the Users screen for old accounts belonging to former freelancers or employees. Remove them or downgrade them to the lowest role they actually need. Third, add two factor authentication for every account with editor or administrator rights. Even if a password leaks, an attacker without the second factor gets nowhere.

Limiting login attempts is also worth doing. Many hosting companies do this at server level, and most security plugins offer it as a simple toggle.

Choose WordPress security plugins carefully

A good security plugin acts as a firewall, a scanner and an alarm system in one. The well known options all cover the basics: blocking malicious traffic, scanning files for changes and alerting you when something looks wrong. The mistake people make is installing two or three of them at once, which slows the site and causes conflicts. Pick one, configure it properly and read its weekly report.

Check whether your host already provides a web application firewall. If it does, you may only need a lightweight plugin for login protection and file monitoring.

Back up as if you will need it tomorrow

Every item on this WordPress security checklist reduces risk, but none of them removes it entirely. Backups are what turn a disaster into an inconvenience. A proper WordPress backup includes both the database and the wp-content folder, runs automatically, and is stored somewhere other than your own server.

Daily backups suit most active sites. Keep at least two weeks of history, because some infections go unnoticed for days, and you need to be able to roll back to a clean version. Once a quarter, test a restore on a staging site. A backup you have never restored is a hope, not a plan.

Harden the server and file settings

A few technical changes close doors that attackers like to use. The official WordPress hardening guide covers them in detail, but the key points are simple enough to ask your host about.

Make sure the site runs on HTTPS everywhere, with a valid SSL certificate. Disable file editing inside the dashboard by adding a single line to wp-config.php, so that anyone who gets into an admin account cannot rewrite your theme files. Keep the PHP version current, since old versions no longer receive security fixes. Set correct file permissions, and move wp-config.php above the web root if your host allows it.

Watch what happens after launch

Security is not a one-off job. Set up uptime monitoring so you hear about problems before your visitors do. Keep an eye on Google Search Console, which warns you if it detects malware or spam pages on your domain. Review your user list and plugin list every quarter.

If you want a broader view that goes beyond WordPress itself, this website security checklist is a useful companion, covering hosting, DNS and email settings that a plugin cannot reach.

Do not forget multilingual and translated versions

Sites that serve several languages often run extra plugins for translation, language switching and localized SEO. Each of these adds code that needs updating and permissions that need checking. When you plan to translate a WordPress website, choose well maintained tools with a clear update history, and include every language version in your backup and monitoring routine. A forgotten subdirectory in another language is just as easy to compromise as your main homepage.

A quick version to pin above your desk

If you only remember a handful of things, make it these: update core, plugins and themes, and delete what you do not use. Use strong passwords, unique usernames and two factor authentication. Run one reputable security plugin, plus server level protection if your host offers it. Keep automatic off-site backups and test them. Use HTTPS, current PHP and sensible file settings.

None of this is glamorous, and that is the point. A secure WordPress site is mostly the result of small, boring habits repeated over time. Put a reminder in your calendar, block out half an hour each month, and you will be ahead of the overwhelming majority of sites that bots are scanning right now.