Clear, practical guidance for securing a WordPress site from the first five minutes to advanced operational hardening.
If you are new, do this in order:
- Read the 5-minute quickstart.
- Use the role-based guide to find your path.
- Check terms you do not know in the glossary.
- Use the checklists for ongoing maintenance.
- If you suspect compromise, open hacked-site triage immediately.
These are the highest-value actions for most sites:
| Action | Impact | Effort | Who should do it first |
|---|---|---|---|
| Update WordPress core, plugins, themes, and PHP | High | Low | Every site owner |
| Remove unused plugins, themes, and accounts | High | Low | Every site owner |
| Enable MFA for privileged users | High | Medium | Admins |
| Enforce HTTPS everywhere | High | Medium | Admins or hosts |
| Verify backups and test restores | High | Medium | Owners and admins |
| Stop editing production directly | High | Medium | Developers and agencies |
- I run a small site: Start with Quickstart, then read Core Hardening and Access & Authentication.
- I manage a business or client site: Start with By Role, then read Backups & Recovery, Hosting, Server & Network, and Monitoring & Incident Response.
- I build custom code: Start with Developer Workflow & Deployment, then review Plugins, Themes & Supply Chain.
- I think the site may be hacked: Go directly to Hacked-Site Triage.
- Quickstart
- By Role
- Glossary
- Checklists
- Core Hardening
- Access & Authentication
- Plugins, Themes & Supply Chain
- Hosting, Server & Network
- Backups & Recovery
- Monitoring & Incident Response
- Developer Workflow & Deployment
- Tools & References
- Hacked-Site Triage
Most recommendations use the same pattern:
- Minimum: the basic version most sites should do
- Better: the stronger setup for sites with moderate effort available
- Advanced: the more mature control for higher-risk or more complex environments
- How to verify: a simple way to confirm the change is real
This structure is meant to help basic users take action quickly without blocking advanced users from going deeper.
To improve the repo, read CONTRIBUTING.md and AGENTS.md. Keep changes practical, source-backed, and easy to understand for a non-expert reader.