WordPress · Free tool

Secure WordPress — the hardening checklist.

Tick the items and watch live how well your WordPress site is set up. 17 concrete, practical measures grouped by login, updates, files and backups. Your progress stays local in your browser.

Access & loginStrong, unique passwordsA unique, long password per account — managed with a password manager. Password generator →Two-factor authentication (2FA)A second factor (app/passkey) makes stolen passwords practically worthless.No user named “admin”Default usernames are the first target for bots — use an individual admin name.Limit login attemptsBrute-force protection (login limit or firewall) against automated attacks on /wp-login.php.

Updates & extensionsCore, themes & plugins up to dateOver 90 % of hacks exploit known gaps in outdated software.Only the extensions you needFully delete unused plugins and themes — don't just deactivate them.Trusted sources onlyNo “nulled”/pirated plugins; they often carry hidden malware.Automatic security updatesAt least let minor and security releases install automatically.

Files & serverHTTPS enforcedAll traffic over TLS, http → https via a 301 redirect. .htaccess generator →Disable file editing in the backendDISALLOW_FILE_EDIT in wp-config.php prevents code changes via the dashboard.Secure .htaccess rulesFile protection (wp-config/xmlrpc), directory listing off, security headers. .htaccess generator →Correct file permissionsFiles 644, directories 755; wp-config.php stricter (600/640).Block PHP execution in uploads/Prevents uploaded files from running as executable code.

Backups & monitoringAutomatic off-site backupsRegular and stored off the server — not just at the same host.Restore testedA backup is only valuable once recovery is proven to work.Security/malware scanRegular scan for malicious code and changes to core files.Uptime/change monitoringFlags outages and unexpected file or user changes early.

FAQ

Frequently asked questions

01How secure is WordPress really?

The WordPress core is well maintained. Most hacks don't come through the core but through weak passwords, missing updates and insecure plugins — exactly the items on this list that you control yourself.

02Isn't a security plugin enough?

A security plugin helps but doesn't replace the basics: up-to-date software, strong logins with 2FA and tested backups. Too many plugins even increase the attack surface.

03Is my progress saved?

Yes — only locally in your browser (localStorage). There's no account and no server; nothing is transmitted or tracked.

04What matters most on the list?

Up-to-date software, strong and unique logins with two-factor authentication, and tested off-site backups. That covers by far the most common attacks.

05What if my site is already hacked?

Then clean up first, harden second — this list is prevention. For emergencies we offer WordPress hack recovery.

No time for the whole list? We'll handle the hardening.

WordPress maintenance More on WordPress security