WordPress Security Checklist for Small Businesses

Small business sites are rarely targeted individually. They're caught by automated scans that look for known weaknesses. This checklist is a realistic baseline: what to have in place so those scans find nothing, and what to know before something goes wrong.

Accounts and access

• Every administrator uses a unique, strong passwordA password manager makes this realistic.
• Two-factor authentication is on for administrators and editorsStops stolen passwords working on their own.
• Only the people who need administrator rights have themEveryone else gets the least role that works.
• Former staff, agencies and freelancers have no accountReview the user list quarterly.
• The default "admin" username isn't in useIt's the first one guessed.

Updates

• WordPress core, plugins and themes are kept up to dateSecurity fixes are the point of most updates.
• Someone owns updates, with a named backup"Somebody" doesn't.
• PHP is a current, supported versionAsk your host.

Plugins and themes

• Every installed plugin and theme is actually usedDelete the rest, including inactive ones.
• Nothing is abandonedA plugin without updates for a long time is a liability.
• Nothing is pirated or "nulled"A common source of built-in malware.

Backups

• Backups run automatically and regularlyFrequency should match how often content changes.
• Copies are stored off the serverBackups on the same server are lost with it.
• A restore has been testedThe first test shouldn't be during an incident.

Hosting and site configuration

• The site is served over HTTPS
• The dashboard file editor is disabledDISALLOW_FILE_EDIT
• PHP can't execute inside the uploads folderWhere your server allows.
• Login attempts are rate-limitedPlugin or host-level.
• Each site has its own hosting account or isolationShared accounts spread infections.

Forms, shops and data

• Payment handling is by a hosted provider, not your own codeReduces what an attacker can steal.
• You know what personal data the site storesNeeded for any breach assessment.

Monitoring and readiness

• You get alerts for new administrators and changed files
• Search Console is set up for the domainIt reports security issues and spam.
• You know who to call if the site is hackedSee the emergency checklist.
• You know where the backups are and how to restore them

If ticking these off is more than you want to take on, security hardening is a one-off review, and ongoing WordPress security keeps it that way from $79/month. If you're already past prevention, start with the WordPress Hacked Site Emergency Checklist.