Bug Circuit

Free tool · no signup

WordPress security checklist with a score

Tick what is true for your site and get a score out of 100 and a short list of the gaps to close first. Every item says why it matters, so you know what you are fixing.

By the Bug Circuit security team · Last updated

Tick what is true for your site today. Weights reflect how often each gap is the way real sites get hacked.

Updates

Logins and users

Plugins and themes

Hosting and files

Backups and monitoring

Hardening and review

Your score
0%High risk

0 of 29 in place. The site is easy to compromise. Start with updates, logins and backups today.

Fix these first

  1. WordPress core updates itself, at least for security releases
  2. Plugins are updated within a week of a release (automatic updates for trusted ones)
  3. Every admin and editor has a long, unique password from a password manager
  4. Two-factor authentication is on for every admin and editor account
  5. Everything comes from the official directory or a vendor you pay, and nothing is pirated
Your results (Markdown)
# WordPress security checklist

Score: 0% (High risk). 0 of 29 items in place.

## Updates

- [ ] WordPress core updates itself, at least for security releases
- [ ] Plugins are updated within a week of a release (automatic updates for trusted ones)
- [ ] Themes are updated, and unused themes are deleted
- [ ] The PHP version is one that still gets security fixes

## Logins and users

- [ ] Every admin and editor has a long, unique password from a password manager
- [ ] Two-factor authentication is on for every admin and editor account
- [ ] There is no user called admin, and every person has their own account
- [ ] Accounts have the lowest role they need, and old users are removed
- [ ] Login attempts are limited or filtered (firewall, rate limit or CAPTCHA)

## Plugins and themes

- [ ] Everything comes from the official directory or a vendor you pay, and nothing is pirated
- [ ] Unused plugins are deleted, not just deactivated
- [ ] No plugin has gone more than two years without an update

## Hosting and files

- [ ] The whole site uses https and http redirects to it
- [ ] Folders are 755, files 644, and wp-config.php is 640 or stricter
- [ ] The dashboard code editor is switched off (DISALLOW_FILE_EDIT)
- [ ] PHP cannot run from the uploads folder
- [ ] wp-config.php has unique security keys and the database user has its own strong password
- [ ] There are no backup, SQL or zip files in the web root, and directory listing is off
- [ ] File transfer uses SFTP or SSH, and the hosting account has two-factor authentication
- [ ] xmlrpc.php is blocked if nothing needs it

## Backups and monitoring

- [ ] Automatic backups run at least daily, are stored away from the server and are kept for 30 days or more
- [ ] A restore has been tested at least once
- [ ] You are alerted when an admin user is added or core files change
- [ ] The site is scanned for malware regularly
- [ ] Google Search Console is set up so security warnings reach you

## Hardening and review

- [ ] A web application firewall sits in front of the site (host, CDN or plugin)
- [ ] Security headers are set (HSTS, nosniff, frame protection)
- [ ] Forms have spam protection and file uploads are limited by type and size
- [ ] A person has tested the site by hand in the last 12 months

## Fix first

1. WordPress core updates itself, at least for security releases. Most hacked sites ran software with a known, already fixed flaw.
2. Plugins are updated within a week of a release (automatic updates for trusted ones). Plugins cause most WordPress compromises, and attackers scan for new flaws within hours of disclosure.
3. Every admin and editor has a long, unique password from a password manager. Reused and guessable passwords are the easiest way in, especially after other sites leak them.
4. Two-factor authentication is on for every admin and editor account. It stops a stolen or guessed password from being enough.
5. Everything comes from the official directory or a vendor you pay, and nothing is pirated. Nulled themes and plugins very often include a backdoor.
6. Unused plugins are deleted, not just deactivated. A deactivated plugin with a flaw can often still be reached by URL.
7. Automatic backups run at least daily, are stored away from the server and are kept for 30 days or more. Backups are what turns a hack or a bad update into an annoyance instead of a disaster.
8. A restore has been tested at least once. Many backups turn out to be incomplete only when they are needed.
How secure is my WordPress site? Work through 29 checks on updates, logins, plugins, hosting, backups and monitoring. Items that are behind most real hacks count for more, so the score reflects risk and not just how many boxes you ticked. Your ticks stay in your browser.

How it works

How the score works

Each item has a weight of 1, 2 or 3. Eight items carry the top weight and are marked key: automatic core and plugin updates, strong unique passwords, two-factor authentication, trusted plugin sources, removing unused plugins, and tested off-server backups. These are the gaps behind the largest share of hacked WordPress sites. The score is the weight of what you ticked divided by the total weight, so ticking easy low-weight items does not hide a missing backup.

The bands are 90 and above (strong), 70 to 89 (decent), 40 to 69 (exposed) and below 40 (high risk). They are a guide to urgency. A site can score well and still be vulnerable to a flaw in a plugin, which is why the last item asks for a manual test.

Why these checks

WordPress itself is regularly patched and rarely the weak point. Most compromises come through plugins and themes with known flaws, stolen or guessed passwords, and loose server settings. So the list is built around the ways sites are actually broken into: keeping software current, making logins hard to take over, removing code you do not need, limiting what a stolen login or an uploaded file can do, and having a backup you have restored at least once.

The tools on this site cover several items directly. The wp-config generator makes fresh keys and turns off the code editor, the .htaccess generator blocks PHP in the uploads folder and hides sensitive files, and the chmod calculator checks file permissions.

Using the result

Start with the five items listed under Fix these first, in order. Tick items only when they are true today and you have checked them, not when you intend to do them. Copy the Markdown report to keep a record, and run the checklist again after any big change such as a new host or theme. Your ticks are saved in this browser only, so you can come back later, and nothing is sent anywhere.

Worked examples

A typical neglected site

Core, plugins, themes, PHP, https, backups, unique passwords, trusted sources and no unused plugins are done. Nothing else.

39% High risk (9 of 29 in place)
Fix first: two-factor authentication, a tested restore, no user called admin

The nine items are good basics, but there is no second factor on logins and nobody has restored a backup.

A tidier site

The same nine, plus two-factor, a tested restore, file permissions, no code editor, login limits, no admin user, alerts and a firewall.

68% Exposed (17 of 29 in place)
Fix first: roles, stale plugins, PHP blocked in uploads

Strong on logins and backups, but the plugin and file-level gaps remain, and those are where web shells arrive.

What the report looks like

Copy the Markdown result.

# WordPress security checklist

Score: 39% (High risk). 9 of 29 items in place.

- [x] WordPress core updates itself
- [ ] Two-factor authentication is on...

Useful to share with a developer, a client or an insurer.

Frequently asked questions

Is WordPress secure?
The core software is well maintained and patched quickly. Sites are mostly hacked through outdated plugins and themes, weak or reused passwords and loose server settings, which this checklist covers.
What is the most important thing to do?
Turn on automatic updates, use unique passwords with two-factor authentication, and keep tested backups off the server. Those three stop or limit the most common attacks.
Do I need a security plugin?
A good one helps with firewall rules, login limits and alerts. It does not replace updates, strong logins and backups, and a plugin you do not maintain adds its own risk.
How often should I run the checklist?
Every few months and after any big change such as a new host, theme or plugin. Quarterly is a good habit.
Why does a deactivated plugin matter?
Its files are still on the server and many flaws can be reached by address even when the plugin is switched off. Delete what you do not use.
What if my score is low?
Do not try everything at once. Fix the top five items, then run it again. Updates, logins and backups come first.
Can a checklist find a hacked site?
No. It measures how well defended you are, not whether you are already compromised. For that, scan the site and review the files, or ask for a manual test.

Keep reading

wp-config.php Hardening GeneratorFresh keys and safer settings..htaccess Security GeneratorBlock PHP in uploads and hide sensitive files.How to fix a hacked WordPress siteA safe, step-by-step cleanup.

See what attackers see, for free

Run the free passive check on your website. No login, no impact on your site, results in seconds.

Ready for the full manual audit? See pricing

WordPress Security Checklist with Score · Bug Circuit