WordPress Security Checklist
Essential action items
Verify WordPress Core is updated automatically and ensure all active plugins and themes are subjected to scheduled, rigorous security audits.
Audit active plugins regularly. Completely delete all inactive, outdated, or deprecated components to radically reduce the application's attack surface.
Restrict admin logins, enforce strong password policies, enable MFA, and actively block default username enumeration paths (e.g., ?author=1).
Deactivate public directory listings and disable XML-RPC functionality to defend against automated, distributed brute-force attacks.
Review server file permission structures. Ensure critical assets like wp-config.php and .htaccess are set to strict read-only states (e.g., 440 or 400).
Review WooCommerce checkout pipelines and customer profiles, ensuring secure payment handling, strict session boundaries, and compliance with PCI-DSS guidelines.
Need a validated assessment instead of a checklist?
Request an authorized NYOXA LABS security assessment and get a clear scope, practical deliverables and professional reporting.
Authorized engagements only · Written scope · Confidential handling
