HostMeOnline
Log in Get Started
← All articles
Guides · 29 October 2026

WordPress Security Checklist for Small Business Websites

WordPress runs a large share of the web, which makes it a regular target for automated attacks. Most successful attacks are not clever. They exploit old plugins, weak passwords or missing backups. The good news is that a short checklist prevents most of them.

1. Keep Everything Updated

  • Update WordPress core, themes and plugins as soon as updates appear.
  • Turn on automatic updates for minor releases and for plugins you trust.
  • Check the site after major updates.

Outdated plugins are among the most common causes of hacked sites.

2. Remove What You Do Not Use

Deactivated plugins and unused themes can still contain vulnerabilities. Delete them. Keep only one default theme as a fallback, plus your active theme.

3. Use Strong, Unique Logins

  • Use a long, unique password for every admin account, stored in a password manager.
  • Avoid the username "admin".
  • Add two-factor authentication through a reputable plugin.
  • Limit login attempts to slow down guessing.

4. Give People the Right Role

Only a few people need to be Administrators. Use Editor or Author for content staff. Remove accounts of people who have left.

5. Choose Plugins and Themes Carefully

  • Download from the official directory or trusted developers.
  • Avoid pirated or "nulled" premium themes, which often contain malware.
  • Check when a plugin was last updated and its reviews.
  • Fewer plugins means fewer risks.

6. Use HTTPS

Install an SSL certificate and make sure the site loads over HTTPS everywhere. Many cPanel hosts include free AutoSSL. Redirect HTTP to HTTPS and fix mixed content warnings.

7. Back Up Regularly and Test a Restore

A backup you have never restored is only a hope. Keep:

  • Daily or weekly backups of files and database, depending on how often you change the site
  • At least one copy stored away from the server
  • A tested restore process

8. Protect Key Files and Settings

  • Set sensible file permissions (commonly 644 for files and 755 for folders; check your host's guidance).
  • Disable file editing in the dashboard from the configuration file.
  • Keep your configuration file out of public reach and keep database credentials private.

9. Add a Security Plugin or Firewall

A reputable security plugin or a web application firewall can block known attacks, scan for malware and alert you to changes. Choose one, configure it and do not stack several.

10. Monitor Your Site

  • Turn on email alerts for admin logins and plugin changes if your security tool supports it.
  • Check Google Search Console for security warnings.
  • Watch for slowdowns, strange pages or spam in search results.

If Your Site Is Hacked

  1. Do not panic. Take the site offline or put it into maintenance mode if needed.
  2. Change all passwords: WordPress, hosting, database and email.
  3. Restore from a clean backup taken before the problem.
  4. Update everything and remove unused plugins.
  5. Scan for malware and check for unknown admin users.
  6. Ask your host for help; they can often see logs.
  7. Request a review in Google Search Console if the site was flagged.

Choose Hosting That Helps

Good hosting supports security with isolated accounts, backups, updated server software and responsive support. HostMeOnline offers cPanel hosting in India, and if you outgrow shared hosting, ViberCloud offers VPS and cloud options. Our guide on moving a website to a new host without downtime can help if you switch.

Marketing Your Secure Site

Once your site is safe and fast, bring visitors. ViralPulse's guide to keyword research is a good place to start.

The Short Version

Update often, delete unused plugins, use strong logins with two-factor authentication, back up and test restores, use HTTPS and monitor. Ten minutes a week prevents most disasters.