WordPress security basics: 7 things to check before launch

Most WordPress security incidents trace back to a handful of avoidable gaps, not sophisticated attacks. Here's a checklist worth running through before any new site launches.

1. Kill the "admin" username

If your admin account is literally named "admin," you've already handed an attacker half of what they need for a brute-force login attempt. Create a differently-named administrator account and delete or demote the default one.

2. Use a real password manager

A long, randomly generated, unique password beats any "clever" pattern you can remember. This applies to the WordPress admin account, the hosting control panel, and the database — three separate, equally important doors.

3. Keep core, themes, and plugins updated

The overwhelming majority of compromised WordPress sites were running an outdated plugin or theme with a publicly known vulnerability. Turn on automatic updates for anything that supports it, and check the rest on a regular schedule.

4. Limit login attempts

Without a limit, WordPress's login form will quietly accept unlimited password guesses. A login-attempt-limiting plugin (or a setting built into your security plugin) closes this off with almost no configuration effort.

5. Enforce HTTPS everywhere

An SSL certificate should already be standard from your host, but double-check every page actually loads over HTTPS, with no "mixed content" warnings from images or scripts still referencing old http:// URLs.

6. Remove anything you're not using

An inactive plugin or theme is still code sitting on your server that can be exploited even while deactivated, in some cases. Delete anything — themes, plugins, old import files — you're not actively using, not just switch it off.

7. Confirm backups exist and restore (see above)

Security and backups are the same conversation. If every other item on this list fails, a tested, working backup is what turns a disaster into an inconvenience — see our backup guide for the full process.

The takeaway

None of these seven steps require deep security expertise — they're configuration choices, not code. Running through them once before launch closes off the majority of real-world WordPress attacks.