WordPress Security Checklist: Logins, Updates, Backups

The checklist in short

WordPress itself is reasonably secure when kept up to date. The sites that get broken into are usually let down by the things around the core software: weak or reused passwords, plugins nobody has updated in a year, a pirated premium theme, and no backup to fall back on.

If you only have an hour this week, do these five things:

Turn on two-factor login for every administrator account.
Update WordPress, all plugins and the theme, then delete every plugin and theme you do not use.
Remove accounts belonging to former staff, agencies and freelancers.
Confirm you have an automatic backup stored somewhere other than your hosting account, and that someone has tested restoring it.
Replace any nulled (pirated) theme or plugin with a licensed copy.

The rest of this page groups the full checklist by layer: accounts, software, server, application, HTTPS, backups and monitoring, and finally what Thai law expects if personal data leaks. It is about hardening. Routine upkeep by week and month lives in our separate website maintenance checklist.

Logins and user accounts

Automated tools try common usernames and leaked password lists against WordPress login pages all day, every day. The login is the front door, so start there. A Bangkok business often has a website built by one agency, edited by an office assistant, and touched by a freelancer for a promotion, and each of those people may still have an account years later.

Give each person their own account and the lowest role that lets them do their job. Someone who writes blog posts needs the Author or Editor role, not Administrator. A shop assistant processing WooCommerce orders can use the Shop Manager role. Shared logins make it impossible to know who changed what, and impossible to remove one person without resetting everyone.

No 'admin' usernameAdministrator accounts should use names that are not guessable from the site or staff emails.
Long, unique passwordsA password manager for everyone with a login; no passwords shared on LINE chats or sticky notes.
Two-factor loginAn authenticator app code on every Administrator and Editor account.
Least privilegeAuthor, Editor or Shop Manager roles for staff; Administrator only for the people who truly need it.
OffboardingRemove or downgrade accounts the day a staff member, agency or freelancer leaves.
Quarterly reviewList all users, check last login dates, delete what nobody recognises.

Updates, and what to delete

Most published WordPress vulnerabilities are found in plugins and themes rather than in WordPress core. When a fix is released, the details become public, and attackers start scanning for sites that have not updated. The window between a patch and mass exploitation can be short, so a site updated "when someone remembers" is exposed for weeks at a time.

Updating does carry some risk of breaking a layout or checkout, which is why careful teams test updates first on one of the staging sites that mirror the live site. For a small brochure site, updating directly with a fresh backup in hand is usually acceptable.

Nulled themes and plugins

A "nulled" theme is a paid product with its licence check stripped out, shared free on download sites. These copies frequently include hidden code: spam links, backdoor admin accounts or redirects to other sites. They also never receive updates. If your site was built with one, budget for replacing it; saving the licence fee is not worth the clean-up.

Core updatesKeep WordPress on the current release; minor security releases can update automatically.
Plugin and theme updatesCheck weekly, or enable automatic updates for well-maintained plugins.
Delete, do not deactivateDeactivated plugins still sit on the server and can still be attacked.
Check for abandoned pluginsA plugin with no update in a long time, or removed from the WordPress.org directory, needs replacing.
Licensed copies onlyBuy premium themes and plugins from the developer; remove any nulled files.

Server and hosting settings

Some security sits below WordPress, in the hosting account, and only your host or developer can change it. Ask these questions when you review your hosting:

Which PHP version runs the site? Old PHP versions stop receiving security fixes. The PHP project publishes which versions are still supported, and your host's control panel shows which one you are on.
Is my site isolated from other sites? On cheap shared plans, one hacked site on the same account can infect its neighbours. Keep each site in its own account or container where you can.
Is there a server-level firewall and malware scanning? Many hosts block known attack patterns before they reach WordPress.
Are file permissions correct? WordPress files should not be writable by everyone. The WordPress hardening guide lists sensible defaults.
Who has FTP, SSH or control panel access? Apply the same offboarding rules as for WordPress logins.

Hosting quality varies a lot in Thailand, from local providers with Thai-language support to international cloud platforms. We compare the options in our guide to choosing web hosting in Thailand.

Firewall, login limits and file editing

Inside WordPress, a few settings close common routes in.

Web application firewall

A web application firewall (WAF) inspects requests and blocks known attack patterns, such as attempts to exploit a published plugin flaw. It can run as a WordPress plugin (Wordfence and Solid Security are common examples) or in front of the site at DNS level through a service like Cloudflare or Sucuri. A DNS-level firewall stops bad traffic before it reaches your server, which also saves server resources.

Login rate limiting

Limit how many failed logins one address can attempt before it is locked out for a while. Most security plugins and many hosts offer this. Combined with two-factor login, it makes password guessing close to pointless.

Disable the file editor

By default, an Administrator can edit theme and plugin code from the dashboard. If an attacker gets into an admin account, that editor lets them plant code in seconds. Adding define('DISALLOW_FILE_EDIT', true); to wp-config.php switches it off, as the WordPress hardening guide recommends.

XML-RPC

XML-RPC is an older interface used by some apps and services to talk to WordPress. It is also used for password-guessing attacks. If nothing on your site depends on it, block it at the server or with your security plugin. Check first if you use a mobile publishing app or Jetpack.

HTTPS and security headers

Every page, including the login and checkout, should load over HTTPS, and plain HTTP addresses should redirect to it. Browsers mark pages without it as not secure, and any contact form without it sends names and phone numbers in readable text. Our SSL and HTTPS guide covers certificates and renewal.

Security headers are short instructions the server sends with each page. A sensible basic set:

Strict-Transport-Security tells browsers to use HTTPS only.
X-Content-Type-Options: nosniff stops browsers guessing file types.
X-Frame-Options or a frame-ancestors rule stops other sites loading yours inside a frame to trick visitors.
Referrer-Policy limits what address information leaks to other sites.

A full Content Security Policy is stronger but easy to get wrong on a site with many plugins, so treat it as a developer task and test it before switching it on.

Backups and monitoring

No checklist makes a site impossible to break into. Backups and monitoring decide whether a bad day becomes a bad month.

Backups stored away from the site

Keep automatic backups of both files and database, stored off the server, for example in cloud storage the hosting account cannot reach. A backup kept only on the same server can be deleted or infected along with the site. Frequency should match how often the site changes: a shop taking daily orders needs more than a brochure site. Setup and restore testing are covered in our guide to WordPress backups.

Monitoring that tells you early

Uptime monitoring alerts you when the site goes down, often the first sign of trouble.
File-change alerts from a security plugin flag new or modified core files you did not touch.
Activity logs record logins, new users and setting changes, which matters later if you need to reconstruct what happened.
Google Search Console has a Security issues report that shows if Google has detected hacked content, malware or deceptive pages on your site. Make sure the owner, not only the agency, has access and receives its emails.

If personal data leaks: your PDPA duties

This is the part overseas checklists leave out. Thailand's Personal Data Protection Act B.E. 2562 (2019) applies to any business holding personal data about people in Thailand, and a website that stores enquiry forms, customer accounts or orders holds exactly that.

Under section 37(4) of the Act, a data controller must notify the Office of the Personal Data Protection Committee (PDPC) of a personal data breach without delay and, where feasible, no later than 72 hours after becoming aware of it, unless the breach is unlikely to risk people's rights and freedoms. If the risk is high, the affected people must also be told, along with the remedial steps. The PDPC has issued further notifications on how to report; check its website for the current procedure, and take legal advice on your specific case. What a missed notification can cost is set out in our guide to PDPA penalties and fines.

Have a plan before you need it

Know what personal data the site stores, and where: form entries, WooCommerce orders, newsletter lists, plugin logs.
Name who decides whether a breach is reportable, and who contacts the PDPC.
Keep contact details for your developer, host and legal adviser in one place.
Record what happened and what you did, with times. Logs from the previous section help here.

The technical side, cleaning the site and closing the hole, is in our step-by-step guide on how to fix a hacked WordPress site.

Who should own WordPress security?

The worst arrangement is the common one: the agency that built the site assumes the owner handles updates, and the owner assumes the agency does. Write down who is responsible for each item on this checklist, even if the answer is one person.

An in-house approach works when someone technical has an hour a week and the site is simple. It becomes harder with WooCommerce, several languages, many plugins or customer accounts, because updates need testing and alerts need someone to act on them, including during Songkran and other holidays when the office is quiet. If you are weighing it up, our explainer on why website maintenance is important sets out what ongoing care involves.

We offer website maintenance for WordPress and WooCommerce sites, which can cover updates, backups, monitoring and security checks. Each website maintenance plan is priced per site on request, because a five-page brochure site and a busy store need very different amounts of care. Contact us on WhatsApp at +66 93 004 4098 or at service@websitedevelopmentbangkok.com, every day from 10:00 to 19:00 Bangkok time.

More on maintenance and security

Sources

Litesh Dhir, co-founder of Website Development Bangkok

Reviewed by Litesh DhirCo-founder, SEO and web development

Builds and ranks the websites: the systems behind the 17 client sites whose Search Console numbers we publish. This guide was written by the Website Development Bangkok team. More about us

Common questions

Is WordPress secure enough for a business website?

Yes, when it is looked after. WordPress core has a dedicated security team and releases fixes regularly. Problems usually come from what surrounds it: weak passwords, outdated or abandoned plugins, pirated themes and cheap hosting without isolation. A business site with two-factor login, prompt updates, a small set of well-maintained plugins and off-site backups is in a strong position.

Do I need a security plugin on WordPress?

It is not mandatory, but most business sites benefit from one. A security plugin can add two-factor login, login rate limiting, a firewall, file-change alerts and an activity log in one place. Some of these can come from your host or a DNS-level service such as Cloudflare instead. Avoid stacking several security plugins, as they overlap and can conflict.

How do most WordPress sites get hacked?

The common routes are known vulnerabilities in plugins or themes that were not updated, stolen or guessed passwords, and nulled themes or plugins that arrive with hidden code. Less often, a compromised neighbouring site on the same shared hosting account is the way in. That is why updates, two-factor login and licensed software sit at the top of this checklist.

Do I have to report a hacked website under PDPA?

If the hack involves personal data, for example enquiry form entries or customer orders, section 37(4) of the PDPA requires notifying the Office of the PDPC without delay and, where feasible, no later than 72 hours after becoming aware, unless the breach is unlikely to risk people's rights and freedoms. High-risk breaches must also be reported to the people affected. Take legal advice on whether your case is reportable.

How often should I review who has access to my site?

At least every quarter, and immediately whenever a staff member, agency or freelancer stops working with you. Review WordPress users, hosting control panel and FTP accounts, domain registrar access, and Google Search Console users. Remove anyone you do not recognise and downgrade roles that are higher than the person needs.

Tell us about your website

Send a few lines on WhatsApp or through the quote form. You get a written quote with the scope, timeline and price for your project.

Chat on WhatsApp Get a quote

Or WhatsApp or call +66 93 004 4098, every day, 10:00 to 19:00 ICT. service@websitedevelopmentbangkok.com

A WordPress security checklist for business websites in Thailand