Most WordPress sites don't get hacked because of some clever, targeted attack. They get hacked because something small slipped through the cracks: a plugin nobody updated, a user account nobody deactivated, a password that's been the same since 2019. The good news is that a quarterly review catches almost all of it.
You don't need to be a developer to run this checklist. Set a recurring reminder every three months, block off 30 minutes, and work through the list below. Think of it as a health checkup for your site, not a one-time fix.
Why Quarterly Reviews Matter for WordPress Security Best Practices
WordPress security best practices aren't a set-it-and-forget-it thing. New vulnerabilities get discovered in plugins and themes every week. Your site's user list grows and shrinks. Old tools get abandoned by their developers. A checklist you ran a year ago tells you almost nothing about your risk today.
Quarterly is a good cadence because it's frequent enough to catch problems early, but not so often that it becomes a chore you skip. If your site handles sensitive customer data or processes payments, you might want to run a lighter version of this check monthly instead.
1. Update Everything, Then Check What Didn't Update
Start with the obvious: WordPress core, all plugins, and your theme. But don't stop at clicking "update all." Go back and check which items failed to update or are stuck on an old version. Abandoned plugins (ones that haven't been updated in over a year) are one of the most common entry points for attackers.
If a plugin hasn't been touched by its developer in 12+ months, consider replacing it, even if it still technically works.
2. Review Every User Account
Go to Users in your WordPress dashboard and look at every single account. Ask yourself:
- Does this person still need access?
- Do they have the right role, or more permissions than they actually use?
- Is this an old freelancer or agency account that should've been removed months ago?
Remove or downgrade anything that doesn't pass the test. A former contractor with an admin account they forgot about is a bigger risk than most external attacks.
3. Audit Your Passwords and Login Security
Check that every admin-level account uses a unique, strong password, not something reused from another site. If you haven't already set up two-factor authentication, this is the quarter to do it. We walked through the exact steps in How to Set Up Two-Factor Authentication on WordPress in Under Ten Minutes, and it genuinely takes less time than reading this section.
While you're in there, confirm login attempt limiting is still active. Brute force bots don't stop trying just because you set it up once. For a deeper look at balancing security with usability, see How to Limit Login Attempts on WordPress Without Frustrating Real Users.
4. Check for Unfamiliar Files and Admin Users
Attackers who gain access often leave backdoors behind, small files that let them back in even after you've cleaned up the obvious mess. Use your host's file manager or SSH access to scan for files with unusual names in your uploads folder, or files with recent modification dates that you didn't touch.
Also double-check your admin user list one more time here specifically for accounts you don't recognize. This is a different check from step 2, because a compromised site can have a rogue admin account added without ever showing up in your normal workflow.
5. Review Your Backup Situation
Ask yourself honestly: if your site got wiped tomorrow, could you restore it in under an hour? Confirm backups are actually running, not just configured. Confirm they include both files and the database. And actually test a restore on a staging copy at least once a year, not just when disaster strikes.
A good managed hosting setup runs automatic daily backups to a separate location, so this step becomes more of a spot-check than a scramble. If you want to understand what a solid backup setup should look like, our backup overview covers the basics.
6. Run a Malware and File Integrity Scan
Even with everything updated and access locked down, it's worth running a scan that compares your core WordPress files against the official versions and flags anything that's been modified or injected with suspicious code. Plugins like Wordfence or Sucuri can do this, or your host may offer scanning as part of the hosting environment itself.
If you're not sure how thorough your current protection is, How to Audit Your Current Website Security Protection Without Hiring a Specialist walks through a broader audit process.
7. Check Your SSL Certificate and HTTPS Setup
Confirm your SSL certificate is valid and set to auto-renew. Also check that every page actually loads over HTTPS, not just your homepage. Mixed content warnings (where some resources load over HTTP) are common after theme or plugin updates and quietly undermine your security posture.
8. Review Your Firewall and Access Rules
If you're using a web application firewall, take a few minutes to review the block logs. Are there patterns of repeated attacks from the same countries or IP ranges? Are your rate limiting rules still appropriate for your current traffic levels? A WAF that was configured two years ago might not reflect how your site is used today.
Making the Checklist Actually Happen
The biggest reason security checklists fail isn't that people don't know what to check. It's that nobody schedules the time. Put a recurring calendar event on the books right now, quarterly, with this list attached. Better yet, delegate specific items to whoever manages your site day to day.
If your WordPress dashboard shows security warnings or flags outdated components automatically, use that as your starting checklist rather than reviewing everything manually from scratch. A good managed WordPress setup will surface these warnings for you before you even start clicking through settings.
The Takeaway
None of these eight steps take more than a few minutes individually. Together, they cover the vast majority of ways WordPress sites actually get compromised. Security best practices aren't about finding some perfect, uncrackable configuration. They're about closing the small, boring gaps before someone else finds them first. Put it on the calendar, work the list, and move on with your quarter.
