A WordPress website should be regularly checked at both the file and database level to ensure that it remains clean contains only authorized users and has the required protections against unauthorized changes. The following security checks help strengthen WordPress security and reduce the risk of common hacking attempts.
A. cPanel → File Manager → public_html
- Verify WordPress core checksum files under public_html
- Verify index.php file for suspicious code
- Verify wp-config.php for suspicious code
- Verify .htaccess files for suspicious rules
- Check uploads directory for PHP/executable files
- Check recently modified website files
- Check mu-plugins for any suspicious file(s)
- Verify and remove suspicious/unwanted plugins
- Verify and remove suspicious/unwanted themes
- Enable chattr on public_html, exclude /uploads if needed
B. cPanel → phpMyAdmin → WordPress Databas
- Remove suspicious/unauthorized admin users from table wp_users
- Rename WordPress default admin username
- Enable database triggers on the table wp_users
- Regenerate WordPress security keys and salts
C. WordPress → WP Admin
- Verify WordPress plugins and remove unwanted/unknown
- Disable new plugin installation if possible
- Verify WordPress, plugins and themes are updated
- Install 2-Factor Authentication on wp-admin
- Disable or restrict XML-RPC if not required
D. cPanel / Hosting Account
- Verify hosting account cron jobs
- Review website access and error logs
- Keep the latest supported PHP version
- Change cPanel/wp-admin credentials after a confirmed compromise
E. Hosting Provider / External Security
- Ask hosting service provider to Imunify the website
The following section provides a brief explanation of each security check listed above, including its purpose and how it helps strengthen the overall security of a WordPress website.
1. Verify WordPress Core Files Under public_html
Check the WordPress core files under public_html to confirm they are original and have not been modified or infected. Any unexpected or altered core file should be investigated and restored from a clean source.
2. Verify index.php for Suspicious Code
Review the website’s index.php file for unknown, injected, or suspicious code. If malicious code is found, clean the file carefully or restore it from a verified clean copy.
3. Verify wp-config.php for Suspicious Code
Check wp-config.php for unauthorized code, unknown includes, or suspicious modifications. Keep only the legitimate WordPress configuration and required website settings.
4. Verify .htaccess Files for Suspicious Rules
Review .htaccess files for suspicious redirects, unknown rules, or malicious code. Remove unauthorized rules while keeping the legitimate WordPress and website configurations intact.
5. Check the uploads Directory for PHP/Executable Files
Review the WordPress uploads directory for unexpected PHP or executable files, as this directory normally contains media files. Any suspicious executable file should be investigated and removed if confirmed malicious.
6. Check Recently Modified Website Files
Review recently modified files to identify unexpected changes that may indicate an infection or unauthorized activity. Investigate modifications that do not match legitimate website updates or development work.
7. Check mu-plugins for Suspicious Files
Review the mu-plugins directory for unknown or suspicious files that may execute automatically with WordPress. Verify each file and remove anything confirmed as unauthorized or malicious.
8. Verify and Remove Suspicious or Unwanted Plugins
Check plugin directories for suspicious, unused, unauthorized, or unknown plugins. Remove plugins that are confirmed unnecessary or malicious while keeping required website plugins intact.
9. Verify and Remove Suspicious or Unwanted Themes
Review installed theme directories and identify unknown, unused, or suspicious themes. Remove unnecessary or malicious themes after confirming they are not required by the website.
10. Enable chattr Security on public_html
Apply appropriate chattr protection to public_html after confirming that the website is clean. This helps restrict unauthorized file modifications; /uploads can be excluded where legitimate write access is required.
11. Remove Suspicious or Unauthorized Users from wp_users
Review the WordPress wp_users table and confirm that all administrators and users are genuine. Investigate and remove any unauthorized or suspicious account after confirming it does not belong to the website.
12. Rename the Default WordPress Admin Username
Avoid using a predictable default username such as admin for an administrator account. Use a unique administrator username to make unauthorized login attempts more difficult.
13. Enable Database Triggers on the wp_users Table
Apply and manage the required security triggers on the WordPress wp_users table. These triggers help restrict unauthorized user creation, modification, password/profile changes, and deletion.
14. Regenerate WordPress Security Keys and Salts
Regenerate the WordPress authentication keys and salts after a security compromise or when required. This invalidates existing WordPress login sessions and requires users to authenticate again.
15. Verify WordPress Plugins and Remove Unwanted/Unknown Plugins
Review all plugins from the WordPress Admin area and confirm that each installed plugin is genuine and required. Remove unused, unknown, or unauthorized plugins to reduce unnecessary security risks.
16. Disable New Plugin Installation If Possible
Restrict new plugin installation when regular installation access is not required. This helps prevent unauthorized or compromised administrator accounts from installing unwanted plugins.
17. Keep WordPress, Plugins, and Themes Updated
Keep WordPress core, active plugins, and themes updated to supported and secure versions. Updates help fix known vulnerabilities and improve the overall security of the website.
18. Enable Two-Factor Authentication for wp-admin
Enable Two-Factor Authentication (2FA) for WordPress administrator accounts. This adds an additional verification step and helps protect accounts even if a password is compromised.
19. Disable or Restrict XML-RPC If Not Required
Disable or restrict WordPress XML-RPC when the website does not require its functionality. This can reduce unnecessary exposure to automated login attempts and XML-RPC-related abuse.
20. Verify Hosting Account Cron Jobs
Review cron jobs configured within the hosting account and confirm that each scheduled task is legitimate. Unknown or suspicious cron jobs should be investigated and removed if unauthorized.
21. Review Website Access and Error Logs
Check website access and error logs for unusual requests, repeated failed attempts, suspicious URLs, or unexpected activity. Logs can help identify potential attacks and provide useful information during security investigations.
22. Keep a Supported PHP Version
Use a current supported and compatible PHP version for the website. Unsupported PHP versions may no longer receive security fixes and can expose the website to known vulnerabilities.
23. Change cPanel and wp-admin Credentials After a Confirmed Compromise
After a confirmed website compromise, change the affected cPanel and WordPress administrator credentials using strong, unique passwords. This helps prevent continued access through credentials that may have been exposed.
24. Ask the Hosting Provider to Scan the Website with Imunify
Request the hosting provider to perform an Imunify security/malware scan where the service is available. Review detected threats and ensure confirmed infections are properly cleaned, quarantined, or removed.
Important Note:
WordPress security should not rely on a single protection method. Completing all recommended checks including file and database protection, authorized user verification, malware scanning, secure configurations, regular updates, and access monitoring helps reduce the risk of unauthorized changes and website compromise. These measures significantly strengthen website security, but no security configuration can guarantee 100% protection against hacking or future threats.
