WPLista — WordPress Security, Optimization & Hardening Checklist

wp-config

1 item

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox1 as completed	High	Rotate security keys and salts. Change security keys and salts in wp-config.php to ensure proper site protection and force logout on active sessions.	WordPress.org	Link

Login Page

7 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox2 as completed	High	Block multiple failed login attempts. Block repeated login attempts to protect against brute-force and dictionary attacks.	Jetpack Security	Filter
Mark item checkbox3 as completed	High	Enable Two-Factor Authentication (2FA/MFA). Enable two-factor authentication to add an extra layer of defense for administrator and editor accounts.	Melapress (WP 2FA & Activity Log)	—
Mark item checkbox4 as completed	Medium	Enforce login using email address instead of username. Use the email address as the identifier to log in rather than a predictable username.	Melapress (WP 2FA & Activity Log)	Filter
Mark item checkbox5 as completed	Medium	Remove links to your login page from your active theme. Remove theme links pointing to the login page to reduce automated bot discovery.	Hide My WP Ghost	—
Mark item checkbox6 as completed	High	Enforce strong passwords with uppercase, lowercase, numbers, and symbols on all accounts. Require passwords containing uppercase and lowercase letters, numbers, and special characters across all user accounts.	Melapress (WP Password Policy Manager - WP PPM)	—
Mark item checkbox7 as completed	Medium	Rotate passwords periodically. Change passwords regularly to reduce the window of opportunity for compromised credentials.	Melapress Login Security	—
Mark item checkbox8 as completed	Low	Make login error messages generic. Configure login error messages to remain generic without disclosing whether the username or password was incorrect.	Wordfence	Filter

Admin Panel

6 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox9 as completed	High	Keep WordPress updated to its latest version. Keep WordPress core updated to ensure you have the latest security patches, bug fixes, and features.	Solid Security Pro	—
Mark item checkbox10 as completed	High	Do not use an account with username 'admin'. Create a new one and delete the default. Avoid using the default 'admin' account. Create a unique administrative username and remove the default one.	Wordfence	—
Mark item checkbox11 as completed	Medium	Create an Editor account and use it solely for publishing content. Create an account with the Editor role for routine publishing, following the principle of least privilege.	Melapress Login Security	—
Mark item checkbox12 as completed	High	Enforce SSL/TLS across the entire administrative dashboard. Enforce SSL across the entire wp-admin dashboard to encrypt communication and protect session cookies.	—	—
Mark item checkbox13 as completed	Medium	Install file integrity monitoring to detect modified files. Deploy file integrity monitoring to detect unauthorized modifications or web shell injections across site files.	Wordfence	—
Mark item checkbox14 as completed	High	Scan site regularly for malware, viruses, and vulnerabilities. Run scheduled malware and vulnerability scans to safeguard the integrity of your WordPress installation.	Wordfence	—

Theme

4 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox15 as completed	High	Keep active theme updated to its latest release. Keep your active theme updated to ensure bug fixes, security patches, and compatibility with WordPress core.	—	—
Mark item checkbox16 as completed	Medium	Delete inactive themes. Remove inactive themes to eliminate unused PHP code and reduce potential attack surface.	Wordfence	—
Mark item checkbox17 as completed	High	Only install themes from trusted and reputable sources. Only install themes from the official WordPress directory or verified vendors to prevent backdoored templates.	Wordfence	—
Mark item checkbox18 as completed	Low	Remove WordPress version disclosure from theme output. Remove WordPress version tags in themes to prevent automated scanners from fingerprinting vulnerable versions.	Hide My WP Ghost	Filter

Development

6 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox19 as completed	High	Always sanitize and escape inputs and outputs during custom development. Use native WordPress escaping and sanitization functions to prevent SQL injection and XSS vulnerabilities.	WordPress Dev	—
Mark item checkbox20 as completed	Medium	Follow WordPress core architectural standards and conventions. Adhere to the WordPress Coding Standards and architecture guidelines for secure, maintainable development.	Template Hierarchy Hooks Actions Filters	—
Mark item checkbox21 as completed	High	Always use Child Themes when customizing third-party themes. Use child themes so customizations remain intact and parent theme security updates can be applied seamlessly.	Generate Child Theme	Manual
Mark item checkbox22 as completed	High	Maintain clean, organized, and modular codebase. Keep code clean and organized: use consistent structures to ensure readability, maintainability, and auditability.	1 2 3 4 5 6 7	—
Mark item checkbox23 as completed	Medium	Avoid generic function and class names; use unique namespaces or prefixes. Avoid generic names: use unique prefixes or namespaces for functions and classes to prevent collisions and hijacking.	—	—
Mark item checkbox24 as completed	High	Prioritize security by design against common web vulnerabilities. Ensure code is hardened against SQLi, XSS, and CSRF using native WordPress sanitization, validation, and nonce APIs.	Tutorial	—

Plugins

6 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox25 as completed	High	Keep all plugins updated to their latest versions. Keep all active plugins updated to ensure security patches and compatibility with the current WordPress release.	Wordfence	—
Mark item checkbox26 as completed	Medium	Delete inactive plugins permanently. Permanently delete inactive plugins to prevent direct HTTP execution of obsolete or vulnerable PHP scripts.	Wordfence	—
Mark item checkbox27 as completed	High	Only install plugins from verified and reputable sources. Avoid pirated or nulled plugins; install only from the official WordPress repository or verified developers.	—	—
Mark item checkbox28 as completed	High	Replace abandoned or unmaintained plugins with actively supported alternatives. Audit plugins and replace unmaintained or delisted tools with secure, active alternatives.	Wordfence	—
Mark item checkbox30 as completed	Medium	Limit total number of active plugins to the essentials. Keep plugin count lean to minimize attack surface, reduce memory consumption, and optimize TTFB.	WP Umbrella	—
Mark item checkbox29 as completed	Low	Enable automatic updates for minor security releases on trusted plugins. Enable auto-updates for minor maintenance and security releases to patch CVEs without manual intervention.	—	—

Database

4 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox31 as completed	High	Change the default 'wp_' database table prefix. Change default database table prefix to a unique random prefix, mitigating automated SQL injection attacks.	Solid Security Pro	Shell Script
Mark item checkbox32 as completed	High	Configure automated weekly offsite database backups. Schedule regular automated backups stored offsite with immutability guarantees to prevent data loss.	Solid Security Pro	—
Mark item checkbox33 as completed	High	Use strong, high-entropy passwords for the database user account. Assign strong, randomized credentials for the MySQL/MariaDB database user and grant only necessary privileges.	Hide My WP Ghost	—
Mark item checkbox97 as completed	High	Regularly optimize WordPress database (prune revisions, spam comments, and transients). Optimize database tables and purge post revisions, spam comments, and expired transients to maintain fast queries.	WP Rocket	—

Hosting

2 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox34 as completed	High	Choose a reliable, security-focused hosting provider. Host WordPress on reliable infrastructure with modern PHP support, server isolation, and proactive DDoS protection.	Hosting.com HostGator	—
Mark item checkbox35 as completed	High	Access your server exclusively via SFTP or SSH with key-based authentication. Disable plain FTP; access files strictly over SFTP or SSH keys to encrypt administrative sessions.	Hetzner Cloud DigitalOcean	—

Server

5 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox36 as completed	High	Maintain a comprehensive disaster recovery and backup routine. Keep automated full-stack backups (database + files) tested regularly for rapid restoration during incidents.	Solid Backups / Solid Security Pro	—
Mark item checkbox37 as completed	Medium	Install and enable WP-CLI for server-side administration. Use WP-CLI to manage updates, verify checksums, and automate security tasks directly from the command line.	Tutorial	—
Mark item checkbox38 as completed	High	Install and configure ModSecurity Web Application Firewall (WAF). Deploy ModSecurity with OWASP Core Rule Set (CRS) to block malicious HTTP requests before reaching PHP.	Tutorial	—
Mark item checkbox39 as completed	Low	Customize Apache server administrator email in error messages. Set ServerAdmin directive in Apache to avoid leaking internal system administrator email addresses.	Htaccess	—
Mark item checkbox40 as completed	Medium	Install and enable PageSpeed module (or equivalent edge caching). Enable server-level asset optimization and caching modules to reduce latency and server overhead.	PageSpeed Module	Module

Security

36 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox41 as completed	High	Obfuscate WordPress file paths and structure to thwart automated scanners. Hide or mask standard wp-content, plugins, and theme paths to reduce fingerprinting by automated botnets.	Hide My WP Ghost	—
Mark item checkbox42 as completed	High	Remove WordPress generator version tag from HTML header. Remove the wp_generator action to prevent reconnaissance scripts from identifying the exact core version.	Hide My WP Ghost	Code
Mark item checkbox43 as completed	High	Block XML-RPC (xmlrpc.php) if not actively utilized. Disable XML-RPC to eliminate brute-force amplification (system.multicall) and DDoS pingback reflection abuse.	Wordfence	Code
Mark item checkbox44 as completed	High	Disable unauthenticated REST API endpoints if not needed. Require authentication for WordPress REST API routes to prevent public user enumeration via /wp/v2/users.	Hide My WP Ghost	Code
Mark item checkbox45 as completed	Medium	Restrict or disable admin-ajax.php for unauthenticated users if unused. Prevent unauthenticated access to admin-ajax.php to avoid denial of service and resource exhaustion.	Code	—
Mark item checkbox46 as completed	Medium	Restrict file uploads strictly to administrative roles. Disallow file uploads for non-admin accounts to prevent untrusted media and payload uploads.	Code	—
Mark item checkbox47 as completed	Medium	Restrict media library queries so users only see their own uploads. Filter AJAX media queries so non-administrators can only view their own uploaded assets.	Code	—
Mark item checkbox48 as completed	Medium	Strip version query strings (?ver=) from CSS and JavaScript files. Remove query parameters like ?ver=x.x.x to prevent fingerprinting and improve proxy cacheability.	Code	—
Mark item checkbox49 as completed	High	Password-protect /wp-admin/ with HTTP Basic Authentication. Add a server-level HTTP authentication barrier on /wp-admin/ to drop brute-force bot requests before PHP runs.	Code	—
Mark item checkbox50 as completed	High	Change default login URL (wp-login.php) to a custom slug. Mask the standard login URL to filter out opportunistic brute-force attacks and automated scans.	iThemes Security	Code
Mark item checkbox51 as completed	High	Implement an emergency recovery maintenance rule for defacement incidents. Configure fallback maintenance directives to immediately isolate the site during an active security incident.	Code	—
Mark item checkbox52 as completed	High	Relocate wp-config.php one directory level above the web root. Move wp-config.php outside public_html to prevent exposure if the web server fails to process PHP files.	Tutorial	—
Mark item checkbox53 as completed	High	Change the default wp-content/uploads directory location. Customize the upload directory name and path to make automated path traversal and injection harder.	Tutorial	—
Mark item checkbox54 as completed	Medium	Configure fallback handling to index.php or maintenance page. Ensure the web server gracefully redirects missing bootstrap requests to index.php or a maintenance template.	Code	—
Mark item checkbox55 as completed	Medium	Redirect malformed requests to robots.txt to the canonical path. Add redirect rules to ensure requests targeting robots.txt resolve cleanly without generating 404 noise.	Code	—
Mark item checkbox56 as completed	High	Enforce strict filesystem permissions (755 for folders, 644 for files, 400 for wp-config.php). Set restrictive file permissions across the server to prevent unauthorized writing and privilege escalation.	Wordfence	Documentation
Mark item checkbox57 as completed	High	Deny public web access to wp-config.php via server rules. Explicitly block web requests to wp-config.php in Apache (.htaccess) or Nginx configuration.	Hide My WP Ghost	Code
Mark item checkbox58 as completed	High	Block web access to license.txt, wp-config-sample.php, and readme.html. Block access to default documentation and sample files that reveal WordPress version details.	Hide My WP Ghost	Code
Mark item checkbox59 as completed	High	Disable the built-in theme and plugin file editor in wp-config.php. Add define('DISALLOW_FILE_EDIT', true) to wp-config.php to prevent code editing from the web dashboard.	Hide My WP Ghost	—
Mark item checkbox60 as completed	High	Disable directory browsing and index listing across all folders. Turn off directory browsing (Options -Indexes / autoindex off) so visitors cannot inspect folder contents.	Hide My WP Ghost	Code
Mark item checkbox61 as completed	Medium	Block author user enumeration query strings (?author=1). Block requests with ?author=N query strings to prevent threat actors from discovering user logins.	Wordfence	Snippet
Mark item checkbox62 as completed	Medium	Block malicious bots, scrapers, and spam user agents at web server level. Filter known malicious user agents, scraping bots, and vulnerability scanners using web server rules.	Wordfence	Code
Mark item checkbox63 as completed	Medium	Block suspicious characters and path traversal patterns in URLs. Filter out path traversal patterns like ../ and %00 null bytes to prevent local file inclusion.	Wordfence	Code
Mark item checkbox64 as completed	Medium	Filter suspicious query strings and code injection signatures in URLs. Block SQL injection, base64 decoding, and script injection strings before they reach WordPress.	Code	—
Mark item checkbox65 as completed	High	Disable execution and upload of PHP files in theme directories. Block execution of PHP scripts in theme subfolders to neutralize uploaded web shells.	Code	—
Mark item checkbox66 as completed	High	Disable execution and upload of PHP files in plugin directories. Deny direct HTTP access to arbitrary PHP files located within plugin assets and directories.	Code	—
Mark item checkbox67 as completed	High	Disable PHP script execution in the /wp-content/uploads/ directory. Prevent PHP execution inside uploads so uploaded malicious files cannot be triggered over HTTP.	Code	—
Mark item checkbox68 as completed	High	Harden and protect the /wp-includes/ system directory. Block direct access to scripts inside wp-includes except for allowed core dependencies.	Code	—
Mark item checkbox69 as completed	High	Deny direct HTTP access to files inside /wp-includes/. Configure server rules to prevent direct browser requests to internal core library scripts.	Code	—
Mark item checkbox70 as completed	High	Block web access to hidden files and dotfiles (.git, .env, .htaccess). Prevent access to hidden files and repositories (.git, .env, .bak) containing credentials or source code.	Code	—
Mark item checkbox71 as completed	High	Configure HTTP security headers to prevent MIME sniffing and clickjacking. Deploy X-Content-Type-Options: nosniff, X-Frame-Options: SAMEORIGIN, and Referrer-Policy.	Code	—
Mark item checkbox72 as completed	Medium	Handle Apache 404 errors securely without leaking system info. Provide custom error documents to prevent Apache from leaking internal paths, OS details, and server versions.	Code	—
Mark item checkbox73 as completed	Medium	Remove server version signatures and banners (ServerSignature Off). Disable server banners and expose_php to hinder attackers from fingerprinting web server and PHP versions.	Code	—
Mark item checkbox74 as completed	Medium	Protect .htaccess configuration file from web access and tampering. Ensure .htaccess cannot be read over HTTP and has permissions set to prevent unauthorized overwrites.	Code	—
Mark item checkbox75 as completed	Medium	Block comment submissions lacking a legitimate HTTP Referer. Reject automated comment spam sent directly by bots without visiting the post page.	Code	—
Mark item checkbox76 as completed	Medium	Disable PHP easter egg query strings (?=PHPB8B5F2A0-...). Set expose_php = Off in php.ini to disable built-in easter eggs that reveal PHP installation details.	Code	—

Performance

22 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox77 as completed	High	Enable Gzip compression for text, HTML, CSS, and JavaScript. Compress static assets with Gzip to shrink payload size and speed up page load times.	Code	—
Mark item checkbox78 as completed	High	Enable Brotli compression on the web server. Use Brotli compression (br) for up to 20% better compression ratios over Gzip on modern browsers.	Link	—
Mark item checkbox79 as completed	High	Enable DEFLATE compression for static text and web font files. Configure mod_deflate in Apache for SVG, JSON, fonts, and XML files to reduce bandwidth usage.	Code	—
Mark item checkbox80 as completed	High	Enable HTTP Keep-Alive for persistent TCP connections. Allow multiple asset requests over a single TCP connection, reducing TLS handshake overhead.	Code	—
Mark item checkbox81 as completed	High	Configure long-lived browser caching headers (Expires / Cache-Control). Set Expires and Cache-Control headers for static assets (images, CSS, JS) to minimize repeat downloads.	Code	—
Mark item checkbox82 as completed	High	Disable or tune ETags to optimize proxy and browser caching. Unset ETag headers when using cluster environments to prevent validation mismatches and redundant 304 checks.	Code	—
Mark item checkbox83 as completed	High	Enable Vary: Accept-Encoding header for compressed content. Ensure caching proxies serve the correct compressed format (Brotli/Gzip) based on client capabilities.	Code	—
Mark item checkbox84 as completed	High	Enforce latest standards rendering mode (X-UA-Compatible: IE=edge). Send X-UA-Compatible: IE=edge to ensure legacy browsers render modern HTML5 and CSS standards.	Code	—
Mark item checkbox85 as completed	High	Enable support for modern WebXR and immersive reality MIME types. Configure MIME types for modern media formats and interactive 3D assets when required.	Code	—
Mark item checkbox86 as completed	Medium	Dequeue WordPress emoji scripts and styles if not required. Remove print_emoji_detection_script to eliminate unnecessary HTTP requests and inline JavaScript on every page.	Code	—
Mark item checkbox87 as completed	Medium	Dequeue FontAwesome stylesheets and icons if unused. Remove unused icon web fonts to save bandwidth and improve First Contentful Paint (FCP).	Action: WordPress Action: Elementor	—
Mark item checkbox88 as completed	Medium	Dequeue Gutenberg block library CSS if using classic or headless theme. Deregister wp-block-library styles on sites that do not use block editor elements.	Code 1 Code 2	—
Mark item checkbox89 as completed	Medium	Move jQuery and jQuery Migrate scripts to page footer. Defer jQuery execution to the footer to prevent render-blocking and accelerate page rendering.	Code	—
Mark item checkbox90 as completed	Medium	Remove Elementor eicons stylesheet if not required. Dequeue elementor-icons on pages where custom SVG icons or plain text are used.	Code	—
Mark item checkbox91 as completed	Medium	Remove unused Elementor frontend animations CSS. Deregister elementor-animations to eliminate unused CSS rules and improve mobile page score.	Code	—
Mark item checkbox92 as completed	Medium	Disable Google Fonts in Elementor (host fonts locally). Disable remote Google Fonts in Elementor to avoid third-party DNS lookups and GDPR compliance issues.	Code	—
Mark item checkbox93 as completed	High	Optimize image assets and serve modern WebP or AVIF formats. Compress images and adopt next-gen WebP/AVIF formats to significantly reduce page transfer size.	Imagify	—
Mark item checkbox94 as completed	High	Deploy a full-page caching solution (Redis / Memcached / Nginx FastCGI). Cache generated HTML pages in memory to serve visitors instantly without querying MySQL or executing PHP.	WP Rocket	—
Mark item checkbox95 as completed	High	Deploy a Content Delivery Network (CDN) for static asset distribution. Distribute static media, CSS, and JS across edge nodes worldwide to reduce server load and latency.	—	—
Mark item checkbox96 as completed	High	Implement native lazy loading for images and embedded iframes. Add loading='lazy' to off-screen media so assets download only as the user scrolls them into view.	—	—
Mark item checkbox98 as completed	High	Minify and bundle CSS and JavaScript assets. Minify stylesheets and scripts by stripping whitespace and comments to reduce file size and transfer time.	—	—
Mark item checkbox99 as completed	High	Subset and optimize custom web fonts for fast rendering. Subset font files to used glyphs and preload critical WOFF2 fonts to eliminate layout shift (CLS).	—	—

SEO

2 items

Status	Priority	Directive & Recommendation	Official Plugin	Script / Resource
Mark item checkbox100 as completed	High	Deploy an advanced technical SEO and structured Schema suite (Rank Math). Install and configure a modern SEO suite to manage metatags, automated XML sitemaps, Open Graph, 301 redirects, and Schema.org structured data without database bloat.	Rank Math SEO	Sitemap Snippet
Mark item checkbox101 as completed	High	Enable the IndexNow protocol for instantaneous push search indexing. Automate immediate push notifications of created, updated, or deleted URLs directly to Bing, Yandex, and AI engines upon publishing (via Rank Math Instant Indexing or the official Microsoft plugin).	IndexNow Official	IndexNow Guide

wp-config

Login Page

Admin Panel

Theme

Development

Plugins

Database

Hosting

Server

Security

Performance

SEO

Ready to hand off or audit?