Public Exposure
Start with what an unauthenticated visitor or crawler can see: HTTPS behavior, security headers, exposed logs, public archive files, directory listing, login surface, and obvious redirect problems.
Resource
WordPress Security Checklist
A practical security review checklist for public exposure, administrator access, file risk, backup readiness, evidence capture, and incident-response ownership.
Problem, cause, fix, verify
Problem
Security reviews stall when every warning feels urgent but nobody has separated public exposure, access control, backup readiness, and response ownership.
Audience
Site owners, agencies, and administrators running a first-pass WordPress security review before launch, handoff, updates, or incident response.
First check
Start with what an unauthenticated visitor or crawler can see: HTTPS behavior, security headers, exposed logs, public archive files, directory listing, login surface, and obvious redirect problems.
Verify
Remove items that do not apply to the site and add local realities such as membership data, WooCommerce orders, staging domains, or agency-owned accounts. A shorter checklist that matches the actual site is safer than a generic one nobody finishes.
Editorial trust
- Publisher
- WPlura Editorial Team
- Published
- Updated
- Content type
- Resources
On this page
Resource Use
Security reviews stall when every warning feels urgent but nobody has separated public exposure, access control, backup readiness, and response ownership.
For: Site owners, agencies, and administrators running a first-pass WordPress security review before launch, handoff, updates, or incident response.
Checklist Flow
What to review before using it
Access Review
Review administrator accounts, dormant users, recent privilege changes, weak handoff practices, and whether every privileged account still has a known owner.
File And Backup Risk
Check whether debug files, backup archives, export files, or staging leftovers are reachable from the public web. Confirm a usable restore path before making destructive cleanup changes.
Incident Notes
If something looks suspicious, record URLs, timestamps, affected accounts, and public evidence before deleting files or users. Cleanup without evidence makes support escalation harder.
WPlura Review Path
Use SiteCheck for public exposure signals and Security Center documentation for the WordPress-side review. Treat these as review aids, not a replacement for professional incident response when unauthorized access is confirmed.
Review Cadence
Run the checklist before launches, after handoffs, after major updates, and whenever a public scanner or client report changes the risk picture. A dated review note is more useful than a vague assurance that security was checked, especially when several teams share responsibility.
Escalation Triggers
Move from checklist review to specialist support when you find unknown administrators, executable files in uploads, public database exports, active redirects, payment-page tampering, or evidence that a cleanup could destroy forensic context. The checklist should help name the risk and owner, not encourage risky removal work.
Finish With Verification
Close the review by retesting the affected public URLs, login path, exposed-file checks, backup evidence, and administrator list. A useful security checklist ends with what changed, what still needs review, and who is responsible for the next check.
Keep The Checklist Useful
Remove items that do not apply to the site and add local realities such as membership data, WooCommerce orders, staging domains, or agency-owned accounts. A shorter checklist that matches the actual site is safer than a generic one nobody finishes.
Download
Use this checklist without an email gate
Last updated 2026-09-14.