WordPress Security Checklist for Small Businesses (2026)

A solid WordPress security checklist comes down to a handful of habits: keep everything updated, lock down logins, take off-site backups, run fewer and better plugins, and have someone watching. None of it requires a big budget, but it does require consistency. Below is the checklist we use for small business sites, in plain language, with notes on what you can do yourself and what is worth handing to a developer.

Why small business WordPress sites get attacked

Most attacks on small business websites are not personal. Automated bots scan millions of sites looking for known weaknesses: an outdated plugin, a weak admin password, a forgotten test install. If your site has the weakness, it gets hit, whether you sell cupcakes or run a law firm.

The good news is that this makes security very manageable. You do not need to outsmart a determined hacker; you need to stop being an easy target. WordPress core itself is well maintained, and in our experience most compromised sites we are asked to clean up trace back to outdated plugins or themes, reused passwords or no backups at all.

The cost of skipping the basics is usually higher than the cost of doing them. A hacked site can redirect visitors to spam, get flagged by Google with a browser warning, send junk email from your domain or leak customer data. Cleanup, lost sales and lost trust add up quickly.

The core checklist: updates, logins and backups

If you only do three things, do these. They prevent the large majority of the problems we see.

1. Keep WordPress, plugins and themes updated

• Apply WordPress core minor (security) updates promptly; WordPress can install these automatically.
• Update plugins and themes at least weekly, ideally after testing on a staging copy of the site.
• Delete plugins and themes you are not using. Deactivated code can still be exploited if it sits on the server.
• Check that your hosting runs a supported version of PHP. Old PHP versions stop receiving security fixes.

2. Lock down logins

• Give every person their own account. No shared “admin” logins.
• Use long, unique passwords stored in a password manager.
• Turn on two-factor authentication (2FA) for every administrator and editor. This means a code from your phone is needed in addition to the password.
• Limit login attempts so bots cannot guess passwords endlessly.
• Give people the lowest role they need. A blog writer usually needs “Author” or “Editor,” not “Administrator.”
• Remove accounts for former staff, freelancers and agencies as soon as the work ends.

3. Take backups you can actually restore

• Back up both the files and the database, daily for active sites.
• Store copies off the server, for example in cloud storage, so a server problem does not take your backups with it.
• Keep several weeks of history. Some infections go unnoticed for days.
• Test a restore at least a couple of times a year. A backup you have never restored is a hope, not a plan.

Hosting and server-level protection

Your host does a lot of security work you never see, so it matters which one you choose. Bargain shared hosting can be fine for a tiny brochure site, but it often means older software, crowded servers and slow support when something goes wrong.

When you evaluate hosting, look for:

• Free SSL certificates so your whole site loads over HTTPS (the padlock in the browser).
• A web application firewall (WAF), which filters malicious traffic before it reaches WordPress. Services like Cloudflare can add one in front of almost any host.
• Isolated accounts, so a hacked neighbor on the same server cannot reach your site.
• Server-level backups and malware scanning as a second safety net.
• SFTP or SSH access instead of plain FTP, which sends passwords unencrypted.

For businesses that need more control, we often set up WordPress on cloud infrastructure with proper firewalls, automated backups and monitoring. That includes AWS setups and migrations for sites that have outgrown shared hosting.

Plugins, themes and hardening settings

Plugins are what make WordPress flexible, and they are also the most common way in. Every plugin is code written by someone else that runs on your site.

Choose plugins carefully

• Prefer plugins that are actively maintained, with recent updates and responsive support.
• Avoid “nulled” (pirated) premium plugins and themes. They frequently contain hidden malware.
• Ask whether you really need a plugin for a small feature. Sometimes a few lines of custom code are safer than a large plugin.

Simple hardening steps

• Disable the built-in file editor in the dashboard so a hijacked account cannot edit theme or plugin code.
• Set correct file permissions so the web server cannot overwrite files it should not.
• Block PHP execution in the uploads folder.
• Disable XML-RPC if you do not use it (some apps and older integrations rely on it, so check first).
• Add security headers such as HTTP Strict Transport Security (HSTS) to tighten how browsers treat your site.

Some of these are a checkbox in a security plugin; others are server configuration that a developer should handle so nothing breaks.

Monitoring and a plan for when things go wrong

Prevention reduces risk, but it never removes it entirely. You also need to know quickly when something is off, and know what to do about it.

• Uptime monitoring alerts you if the site goes down.
• Malware and file-change scanning flags unexpected changes to your code.
• Activity logs show who logged in and what they changed.
• Google Search Console will notify you if Google detects malware or hacked content on your site. It is free and worth setting up.

Write down a short incident plan, even if it is one page: who to call, where the backups live, who has hosting and domain access, and how to put up a maintenance page. When a site is hacked, the first hour matters, and nobody wants to be hunting for a password reset email.

Who should own this checklist?

Here is how we usually see responsibilities split for a small business site.

If keeping up with updates and scans is slipping, a website maintenance plan is usually cheaper than a single emergency cleanup. We also cover what a good plan should include in What a Website Maintenance Plan Should Include.

FAQ

Is WordPress secure enough for a business website?

Yes, when it is maintained. WordPress core has a dedicated security team and regular releases. Most problems come from outdated plugins, weak passwords and poor hosting, all of which you can control.

Do I need a security plugin?

A reputable security plugin is a sensible layer for most small sites, adding login protection, scanning and activity logs. It does not replace updates, backups and good hosting, and stacking several security plugins often causes conflicts rather than more protection.

What should I do if my site has been hacked?

Do not just delete the visible spam. Change all passwords, contact your host, and have the site properly cleaned, including hidden backdoors, before restoring. Then close the hole that let the attacker in, or it will happen again. If you need help, our website security service handles cleanup and hardening.

Make security a routine, not a project

WordPress security is mostly about doing simple things every week: updating, backing up, reviewing users and watching for warning signs. Set up the foundations once, put the routine on a calendar or hand it to someone you trust, and your site stops being an easy target. We work with small businesses across the United States and Canada and can review your current setup and tell you what needs attention.

Want a second pair of eyes on your site? Get a fixed quote within 24 hours for a security review and hardening.