How to use this WordPress security checklist

Work through the groups in order: they go from the changes that prevent the most incidents to the ones that limit damage when something still goes wrong. Each step is something you can do today. Steps marked with a plan name are ones Silent Threads can do or check for you; everything else is plugin-independent and worth doing whatever tools you use.

Hardening isn’t a one-off job. Plugins change, people join and leave, and new vulnerabilities are published every week. Put a recurring reminder in your calendar to go through the list again every three months.

Accounts and logins

Most WordPress compromises don’t need a clever exploit: they use a password that was guessed, reused or phished. Locking down accounts is the cheapest and most effective thing on this list. Two-factor authentication alone defeats guessing and stolen passwords at the same time.

  • Turn on two-factor authentication for every administrator and shop manager. Silent Threads can do this on every plan
  • Give each person their own account with the lowest role that does the job; never share logins.
  • Remove administrator accounts nobody uses, and check the user list for accounts you don’t recognise.
  • Require long, unique passwords (a password manager makes this painless). Silent Threads can do this on every plan
  • Rate-limit and block repeated failed logins. Silent Threads can do this on every plan
  • If nothing you use needs XML-RPC, block xmlrpc.php: one request to it can try many passwords.
  • Don’t use “admin” or the site name as a username.

Updates and vulnerabilities

The second most common way in is a plugin or theme with a known vulnerability that nobody updated. Attackers scan the whole internet for specific vulnerable versions within days of a disclosure, so update speed matters, and so does knowing which versions you run.

  • Keep WordPress core, plugins and themes updated; turn on automatic minor core updates at the very least.
  • Delete plugins and themes you have deactivated; inactive code can still be attacked.
  • Watch for known vulnerabilities (CVEs) in the exact versions you run, not just for “an update is available”. Silent Threads can do this on every plan
  • Only install plugins and themes from their real source; never use “nulled” premium plugins.
  • Prefer software whose updates are signed or otherwise verifiable.

Files and server

These settings limit what an attacker can do even after getting a foothold. If PHP can’t run in uploads, an uploaded web shell is just a harmless file. If the file editor is off, a stolen admin login can’t be turned into code on the server in two clicks.

  • Disable the built-in theme and plugin file editor: define('DISALLOW_FILE_EDIT', true); in wp-config.php.
  • Stop PHP from running inside wp-content/uploads.
  • Keep wp-config.php out of reach: correct file permissions, and never a publicly downloadable copy.
  • Turn off directory listing and on-screen debug output (WP_DEBUG_DISPLAY) on the live site.
  • Use SFTP or SSH, never plain FTP, and give hosting, database and SFTP accounts different strong passwords.
  • Run a supported PHP version (Silent Threads needs PHP 7.4 or newer).
  • Serve the whole site over HTTPS.

Monitoring and detection

Prevention eventually fails somewhere, so the goal is to notice within minutes, not weeks. The fastest signal of a compromise is a new administrator account, and the most reliable proof is a core file that no longer matches its official checksum.

  • Run a web application firewall in front of WordPress. Silent Threads can do this on every plan
  • Scan files and the database for malware regularly, not only after something looks wrong. Silent Threads can do this on every plan
  • Compare WordPress core files against the official checksums. Silent Threads can do this on every plan
  • Get an alert the moment a new administrator account appears. Silent Threads can do this on every plan
  • Add the site to Google Search Console so you hear about security issues Google finds.
  • For shops: watch the scripts that load on the checkout page. Silent Threads Pro and Agency can do this

Backups and recovery

A backup you have never restored is a hope, not a plan. Decide now what you’ll do in the first hour of an incident, while you are calm and have all the passwords to hand.

  • Keep automatic, off-site backups of files and the database, with several days of history.
  • Test a restore at least once, so you know it works before you need it.
  • Write down who to call and what to do first if the site is hacked (hosting login, backups, DNS).
  • After any incident, change every password and the WordPress salts in wp-config.php.

Two wp-config.php settings worth knowing

Two lines in wp-config.php close common routes from a stolen login to code on your server:

  • define('DISALLOW_FILE_EDIT', true); removes the theme and plugin file editor from WordPress admin.
  • define('DISALLOW_FILE_MODS', true); goes further and blocks installing or updating plugins and themes from admin. It suits sites deployed from version control; on most sites it also stops automatic updates, so only use it if you update another way.

Doing it in one click

Many of these settings are tedious to apply by hand on every site. Silent Threads includes 16 one-click hardening checks on every plan, plus a firewall with 356 built-in rules, two-factor authentication, brute-force protection and an instant new-administrator alert. Pro adds Live CVE Correlation, which matches the plugin and theme versions you run against live vulnerability data, and a Security Baseline that tracks drift from your known-good settings. See hardening features.

Get the checklist as a PDF

The same checklist is available as a printable PDF, handy for agencies and for anyone who wants to tick items off on paper. Enter your email below and we’ll send you a link after you confirm your address.

How we checked this guide

Steps follow WordPress’s own hardening documentation and widely accepted practice. Settings such as DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS are documented WordPress constants. Plan labels only mark steps Silent Threads actually covers.