WordPress Security Audit Checklist for Site Owners

Introduction

If you run a WordPress site—whether it’s a small business brochure, a membership platform, or a high-traffic blog—a security breach isn’t a matter of if, but when. I’ve seen too many site owners assume they’re too small to be targeted. They’re wrong. Automated bots scan every site on the internet looking for outdated plugins, weak passwords, and misconfigured files. A single vulnerability can lead to defacement, data theft, or a site that’s completely wiped. That’s why a regular WordPress security audit checklist isn’t optional—it’s part of responsible site ownership. This guide walks you through a practical, hands-on audit process that you can run yourself, even if you’re not a security professional. No fluff, no theory. Just the steps that actually protect your site.

What Is a WordPress Security Audit and Why You Need One

A security audit is a systematic review of your site’s security posture. You’re not just looking for obvious vulnerabilities—you’re checking every layer: user accounts, plugins, themes, file permissions, database configurations, and monitoring systems. The goal is to identify weak points before an attacker does. Many people treat security as a one-time setup. They install a security plugin, change the login URL, and assume they’re done. That’s a dangerous assumption. Security is an ongoing process. New vulnerabilities are discovered every day. Plugins release updates to patch them. If you’re not auditing regularly, you’re falling behind. Even a small site can suffer severe consequences from a breach: lost customer data, damaged reputation, and hours of cleanup downtime. This isn’t about paranoia—it’s about risk management. A security audit gives you a clear picture of where you stand and what needs attention. It’s the difference between reacting to a disaster and preventing one.

Before You Start: What You’ll Need

Before you touch anything, take these steps. First, make sure you have full admin access to your WordPress dashboard. You’ll also need your FTP/SFTP credentials or access to your hosting control panel’s file manager. If you have a staging site, use it for the audit. Audits involve making changes that can break things—a staging site lets you test without risk. If you don’t have a staging environment, that’s fine, but you must have a fresh backup. Site owners who do frequent backups find that tools like UpdraftPlus help automate the process and offer simple restoration. Skip this step at your own peril—I’ve seen site owners lose weeks of work because they skipped a backup before running a security scan. Download a complete backup of both files and database. Store it off-server (Google Drive, Dropbox, or an external drive). Once you have a clean backup, you can proceed with confidence.

Step 1: Review User Accounts and Permissions

Your user accounts are a common entry point for attackers. Start by checking who has access to your site. Navigate to Users > All Users in your WordPress dashboard. Look for any accounts you don’t recognize. Remove them immediately. Then, review role assignments. Only give users the permissions they absolutely need. For example, an editor doesn’t need administrator access. A contributor doesn’t need to edit plugins. This principle is called least privilege, and it limits the damage a compromised account can do. Next, enforce strong passwords. Ban common passwords like ‘admin123’ or ‘password.’ If your team struggles with password creation, a password manager can generate and store complex passwords, so no one has to remember them. A common beginner mistake is still using ‘admin’ as a username. If you are, create a new administrative user with a different username, log in as that user, and delete the old ‘admin’ account. Finally, enable two-factor authentication (2FA). Plugins like Wordfence and iThemes Security offer built-in 2FA options. For a simple, secure solution, use the Google Authenticator plugin. It adds a second verification step that stops automated attacks cold.

Step 2: Audit Your Themes and Plugins

Outdated plugins and themes are the most common cause of successful WordPress attacks. Start by checking for updates. Go to Dashboard > Updates. Install all available updates for plugins and themes. If a plugin hasn’t been updated in over a year, that’s a red flag—the developer may have abandoned it. Check the plugin’s support forum: are there many unresolved issues? A plugin with active support and regular updates is safer. Next, look at your active plugins. Remove any that are unused. Every extra plugin is a potential attack surface. If you’re not using it, delete it, not just deactivate it. Some plugins leave database tables behind even after deactivation. Deleting them removes those tables. When evaluating which plugins to keep, consider commercial vs. free options. Commercial plugins often have dedicated security teams and faster patch cycles. For example, Sucuri Security is a paid plugin that offers comprehensive vulnerability scanning. If a free plugin is essential but poorly maintained, it may be worth paying for a premium alternative. A good rule of thumb: if a plugin handles sensitive data (user logins, payments, or personal info), invest in a reputable commercial version with a proven track record.

Step 3: Harden Your WordPress Configuration

Your wp-config.php file controls core settings. A few changes here can block common attack vectors. First, disable file editing. In your theme and plugin editor, adding this line to wp-config.php prevents anyone from modifying plugin or theme files from the dashboard: define('DISALLOW_FILE_EDIT', true);. Next, change your database table prefix. The default is wp_. Using a custom prefix like xyz_ makes SQL injection attacks harder. If you’re already using the default prefix, you can change it via a plugin or manually via phpMyAdmin, but be careful—this can break your site if done incorrectly. Always test on a staging site first. Also, regenerate your security keys and salts. These keys encrypt user sessions and cookies. If your site has been compromised, resetting them invalidates all existing sessions. Go to the WordPress Salt generator page, copy the new keys, and paste them into wp-config.php. Another important step: disable XML-RPC if you don’t need it. XML-RPC is a remote access protocol often exploited by attackers for brute force attacks. If you don’t use a mobile app or remote publishing, add this to wp-config.php: add_filter('xmlrpc_enabled', '__return_false');. Finally, limit login attempts. Installing a plugin like Login LockDown can block IPs after a set number of failed attempts. And hide PHP version headers—attackers use them to target known vulnerabilities. You can add this line to wp-config.php: remove_action('wp_head', 'wp_generator');. Remember, any change to wp-config.php can break your site. Keep a backup of the original file before editing.

Step 4: Secure Your Login and Admin Area

The login page is one of the most attacked areas of any WordPress site. Start by enforcing strong passwords for all users. If you’ve already done this in Step 1, good—revisit it now to confirm. Next, limit login attempts. Even if you’ve configured it in wp-config.php, a dedicated login limiter plugin provides a user-friendly interface. Use Login LockDown or the built-in feature of Wordfence. Then add CAPTCHA to your login form. reCAPTCHA from Google is free and easy to set up with a plugin like ‘Advanced noCaptcha & invisible Captcha.’ It blocks automated brute force scripts without annoying legitimate users. Two-factor authentication is non-negotiable for admin accounts. Use plugins like Google Authenticator for WordPress or Duo Two-Factor Authentication. They generate time-based codes that expire after 30 seconds, making stolen passwords useless. Finally, consider changing your login URL from the default /wp-login.php. A plugin like WPS Hide Login lets you set a custom slug. This adds an extra layer of obscurity. It’s not a complete solution—determined attackers can still find it—but it stops most bot traffic. The tradeoff is convenience: you’ll need a bookmark or a note to remember the custom URL. If you have multiple users, decide if the added complexity is worth it. For most sites, it is.

Step 5: Check Your File Permissions and Directory Structure

File permissions control who can read, write, or execute files on your server. Incorrect permissions can allow attackers to upload malicious scripts or modify core files. The standard permissions are: 644 for files (owner read/write, group and others read only) and 755 for directories (owner read/write/execute, group and others read/execute). You can check permissions via FTP or your hosting control panel. Most FTP clients display permissions as a three-digit number. Look for any files or directories set to 777—that’s wide open. Even the uploads folder should not be 777. Use 755 instead. The most critical file is wp-config.php. It stores database credentials and secret keys. Set it to 640 or 600 to prevent public access. Some hosts block this file by default, but double-check. If you’re not comfortable checking permissions manually, use a security plugin like WP Security Audit Log. It scans file permissions and reports any issues. Another risk is directory browsing. If your server allows directory listing, anyone can see your file structure. Disable it by adding Options -Indexes to your .htaccess file. Your security plugin may handle this automatically. After making any permission changes, test your site thoroughly. Too-restrictive permissions can break file uploads, plugin updates, or theme customizations. Find the right balance.

Step 6: Review Database Security

Your database contains your content, user data, and settings. A compromised database can lead to data theft or site takeover. Start by changing the default table prefix. If your prefix is wp_, attackers already know the structure. Use a custom prefix like mycustom_. Changing it after the site is live is tricky—use a plugin like ‘Change Table Prefix’ or do it manually via phpMyAdmin. Always backup your database first. Another layer: limit your database user’s privileges. In most shared hosting setups, the WordPress database user has full privileges (GRANT ALL). You can tighten this. Ideally, the user only needs SELECT, INSERT, UPDATE, DELETE, and CREATE TEMPORARY TABLES. If you’re not comfortable adjusting permissions via your hosting panel, leave it as is—but consider it for future audits. Next, scan for suspicious entries. Attackers sometimes inject malicious code into post content or add rogue admin users. Use a plugin like Wordfence or Sucuri for automated scanning. For a manual check, log into phpMyAdmin and review the wp_users table. Look for any usernames you don’t recognize. Also check the wp_posts table for posts with strange code in the content. This step is important because SQL injection is still a common attack vector. Even if your forms use input validation, a vulnerability in a plugin could open the door. A clean database is the last line of defense. Use a reliable backup plugin like UpdraftPlus to automate daily backups. That way, if something goes wrong, you can restore from a known clean version.

Step 7: Monitor and Log Security Events

You can’t fix what you don’t see. Logging gives you visibility into what’s happening on your site. Install a logging plugin like WP Activity Log or Simple History. These plugins track user actions: who logged in, what posts were edited, which plugins were activated. If an attacker gains access, you’ll see the entry point and the damage done. Set up email alerts for critical events. For example, get a notification when a new admin user is created or when a plugin is deactivated. Most logging plugins offer this. If you prefer a managed approach, consider a service like Sucuri or Cloudflare. They provide real-time monitoring, firewalls, and incident response. This is a good option if you don’t want to perform checks manually. For DIY monitoring, check your logs weekly. Look for patterns: repeated failed login attempts from the same IP, edits at odd hours, or plugin installations you don’t remember. Catching a breach early can mean the difference between a quick fix and a full restoration.

Common WordPress Security Audit Mistakes to Avoid

I’ve made most of these mistakes myself, so consider this a shortcut to avoiding them. Mistake one: skipping the backup. It’s tempting to rush in and start tweaking settings. But one wrong change to wp-config.php or a failed plugin update can take your site offline. Without a backup, you’re rebuilding from scratch. Always back up first. Mistake two: ignoring plugin vulnerabilities. People assume that if a plugin is popular, it must be safe. Not true. A plugin with millions of active installs can have a critical vulnerability. Always check the plugin’s update history and support forum. Don’t rely solely on a firewall—firewalls are great but they don’t fix underlying code issues. Mistake three: only using a firewall. A firewall like Cloudflare is an important layer, but it’s not a substitute for securing your WordPress installation. I’ve seen sites with Cloudflare protection that still got hacked because they had outdated plugins and weak passwords. The firewall stops some traffic, but a determined attacker can still find ways in. Mistake four: not testing after changes. You make a permission change, update a plugin, or tweak wp-config—and you assume everything works. Test your site’s functionality: log in, publish a post, upload a file. If something breaks, you want to find it immediately, not days later. A quick test after every change saves you from discovering problems at the worst possible time. Be methodical, not hasty.

Putting It All Together: Your Monthly Security Audit Schedule

Consistency beats intensity. A regular routine is far more effective than a panic-driven audit once a year. Here’s a simple schedule: weekly, monthly, and quarterly. Weekly tasks: check for plugin and theme updates. If updates are available, apply them immediately. Review your security logs for suspicious activity. This takes 10 minutes. Monthly tasks: run the full checklist. Review user accounts, check file permissions, scan for malware, and run a vulnerability scan. Use a tool like WP Activity Log to review all changes made in the past 30 days. This takes 30–45 minutes. Quarterly tasks: do a deeper review. Change passwords for admin accounts. Review database table prefix and permissions. Check for any new plugins or themes that were installed. Re-evaluate your backup strategy. Ensure backups are running and stored off-server. Use a calendar reminder or a project management tool like Trello to schedule these tasks. Start with a weekly check and build from there. A sustainable approach is better than an overwhelming one. Even if you can only commit to monthly audits, it’s vastly superior to doing nothing. Security is a habit, not a project.

Final Thoughts: Don’t Wait for a Breach to Act

A WordPress security audit checklist is worthless if it sits in a notebook. Take action this week. Run through the steps outlined here. If you find issues—and you probably will—fix them. If you lack the time or confidence to manage security yourself, consider a managed solution like Sucuri or Cloudflare. They offer monitoring, firewalls, and response teams that handle the heavy lifting. But even if you outsource, you should still understand the basics. Security is a process, not a product. It requires ongoing attention. The cost of prevention is almost always lower than the cost of recovery. Start now. Your site—and your visitors—will thank you.