How do I check if my WordPress site is secure?

Start with updates (core, plugins, theme), your PHP version, HTTPS and security headers, admin logins and backups. Our free check covers the parts that can be seen from outside in about thirty seconds.

Do I need a security plugin?

A good one helps with login limits and file monitoring, but it does not replace updates and backups. Many hacked sites had a security plugin installed and out of date.

How often should I update WordPress?

Security releases should go on within days. Check for plugin updates at least weekly, or have someone do it for you on a care plan.

Can you fix my WordPress security for me?

Yes. Our Security fix package goes through every finding, fixes them in priority order and re-scans to prove it, for a fixed price agreed before we start.

Security guide

A WordPress security check you can actually do

WordPress runs a huge share of the web, which makes it the most attacked platform on it. Almost every WordPress break-in we see comes down to the same handful of things left undone.

Run the free security check

1. Updates: core, plugins and theme

Out-of-date plugins are the most common way into a WordPress site. Update everything, remove any plugin you are not using (deactivated plugins can still be attacked) and replace plugins that have not been updated by their author in over a year.

2. The PHP version underneath

WordPress is only as safe as the PHP it runs on. See our PHP vulnerability check guide for which versions still get security fixes.

3. HTTPS and security headers

The whole site should load over HTTPS, plain http:// should redirect to it, and the server should send security headers such as HSTS, a Content-Security-Policy and clickjacking protection. Most hosts or a CDN like Cloudflare can add these without touching WordPress.

4. Logins

Use a unique strong password for every admin, turn on two-factor authentication, remove old admin accounts, and limit login attempts. Never share one admin login between people.

5. Backups you have tested

A backup you have never restored is a hope, not a backup. Keep daily copies stored away from the server, and restore one to a test site at least once.

6. Email spoofing protection

Not strictly WordPress, but often forgotten: without SPF, DKIM and DMARC records, anyone can send email pretending to be your business. See the email spoofing guide.

Questions people ask

How do I check if my WordPress site is secure?: Start with updates (core, plugins, theme), your PHP version, HTTPS and security headers, admin logins and backups. Our free check covers the parts that can be seen from outside in about thirty seconds.
Do I need a security plugin?: A good one helps with login limits and file monitoring, but it does not replace updates and backups. Many hacked sites had a security plugin installed and out of date.
How often should I update WordPress?: Security releases should go on within days. Check for plugin updates at least weekly, or have someone do it for you on a care plan.
Can you fix my WordPress security for me?: Yes. Our Security fix package goes through every finding, fixes them in priority order and re-scans to prove it, for a fixed price agreed before we start.

Check your own site in thirty seconds

Our free, passive scan gives you a security score and grade, checks for the issues on this page, and keeps the details private. If you want them fixed, the Security fix package is a fixed price agreed up front.

Run the free security check About the Security fix