Secure a WordPress site

Save files and database Critical step Keep a copy out of the hosting area before any changes.

Update WordPress, theme and extensions Test first on a copy when the site is critical.

Delete unused themes and extensions Deactivation alone does not remove vulnerabilities.

Checking the administrator accounts Critical step Remove unknown accounts and avoid generic identifiers.

Enable the multifactor authentication Critical step At least for administrators.

Limit connection attempts Add delay, blocking or protection at the level of the Commission.

Control File Permissions Avoid permissions too permissive as 777.

Protect wp-config.php and secrets Check keys, FTP accesses and database.

Disable the file editing in the administration Reduce code changes after compromise.

Configure automatic external backups Regularly test restoration.

Check HTTPS and Security Headers Control the Drains and mixed content.

Establish monitoring Availability, file changes and login alerts.