Security Audit checklist for WordPress

by | Sep 15, 2026 | Guidelines & Notes

Skip to main content
How Can We Help?
< All Topics
Print

Security Audit checklist for WordPress

Posted
Updated
Byattractiveuidesign

List of things to check for a WordPress security audit

  • Author enumeration
  • Weak passwords
  • Common usernames (e.g., admin)
  • Changing default WordPress login URL (moving wp-login.php)
  • Utilizing 2FA
  • Limit login attempts
  • Scan for known theme/plugin vulnerabilities
  • Ensure connected to tool for constant security evaluation (for failed login attempts, malware scanning, automatic IP banning, etc.)
  • Ensure backup(s) are configured and running automatically
  • Ensure limited number of Admin users, and delete inactive users
  • Ensure plugins are all up to date
  • Ensure theme is up to date
  • Remove unused plugins
  • Delete extra themes
  • Check WP Core version
  • Check PHP version
  • Check for users who may have SFTP access
  • Install WP Activity Log to monitor the website for a given time (or ongoing)
  • Check for SSL
  • Check for spam prevention on forms, such as Akismet
  • Check DNS for proper SPF, depending on what email address/service is used for wp_mail email sending (e.g., Mailgun)
  • Utilize Cloudflare to help with DDoS protection, etc.
Table of Contents