Most hacked WordPress sites aren’t targeted. They’re found by automated tools looking for outdated plugins and weak passwords. A short security routine once a month closes most of those doors.
Set aside 30 minutes and work through this list.
1. Apply updates
Update WordPress, plugins, and themes. Most attacks use known vulnerabilities that already have fixes. See how to update WordPress safely.
2. Remove what you don’t use
Delete deactivated plugins and unused themes (keep one default theme as a fallback). Check that the plugins you keep are still maintained. A plugin with no updates for a year or more is a risk.
3. Review user accounts
- Remove accounts for people who no longer need access.
- Look for administrators you don’t recognize.
- Make sure everyone has the lowest role they need.
- Confirm two-factor authentication is on for administrators.
4. Run a malware scan
Run a full scan with your security plugin, and an external scan with Sucuri SiteCheck. Investigate any changed core files or unknown files. See why you should regularly scan your code.
5. Check login activity
Look at blocked logins and lockouts in your security plugin. A spike in attempts against one username suggests it has been exposed, so make sure that account has a strong password and two-factor authentication.
6. Verify your backups
Confirm that recent backups exist in remote storage, not just that the schedule is on. Every few months, test a restore on a staging site. See how to set up daily remote backups.
7. Check your SSL certificate
Make sure the certificate is valid and renewing automatically. See how to install a free SSL certificate.
8. Check your PHP version
Old PHP versions stop receiving security fixes. Your host’s control panel shows which version you run. WordPress also flags outdated versions under Tools → Site Health.
9. Look at Google Search Console
Check Security issues and Manual actions. Google often notices hacked content before site owners do.
10. Write it down
Keep a simple log of what you checked and changed. If something goes wrong later, it shows where to start looking.
Make the checklist shorter
Several of these checks (security scans, backups, SSL, and uptime) are exactly what the Repork dashboard is designed to watch for you, so your monthly review starts with what needs attention.
If you think your site has already been compromised, see how to fix a hacked WordPress website.
