WordPress checklist

WordPress powers a huge share of the web, and most of the general checklists on this site apply to a WordPress site exactly as written. This page covers what's genuinely specific to the platform: how its update model, plugin ecosystem and hosting choices create their own set of risks and routines. In keeping with this site's general approach, tool categories are described generically rather than naming specific plugins—the plugin landscape shifts constantly, and the right choice depends on your host and needs.

Core, theme & plugin updates

• WordPress core, the active theme, and every installed plugin are kept on their current, patched versions
• Updates are tested on a staging copy before applying to production for anything beyond a routine minor release, since a plugin update can break a live site with no warning
• Automatic updates are considered for security-critical, low-risk updates, with a documented process for reviewing anything higher-risk manually
• A rollback plan exists (a recent backup, or version control on custom code) before applying any update that touches core functionality

Plugin hygiene

• Every installed plugin serves a genuine, current purpose—plugins installed for a one-off need and forgotten are pure attack surface with no upside
• Deactivated plugins are actually deleted, not left dormant—a deactivated plugin's code is often still present and can still be a vulnerability
• New plugins are chosen based on active maintenance and a track record of prompt security updates, not just feature list or popularity alone
• The total number of plugins is kept as low as the site genuinely needs—each one is both a performance cost and a security dependency

Performance

• A caching solution is in place, appropriate to the hosting environment, so pages aren't regenerated from the database on every single request
• Image optimization is handled at the CMS level so editors uploading full-size photos doesn't silently degrade site speed over time (see the image optimization checklist)
• The theme and page-builder setup are checked for unnecessary bloat—unused blocks, widgets and scripts loaded on every page regardless of need
• Database tables are kept reasonably tidy—old post revisions, spam comments and abandoned draft content are cleaned out periodically rather than accumulating indefinitely

Security hardening

• The default admin username is never used; every account has a unique, strong login and, where supported, multi-factor authentication
• Login attempts are rate-limited or otherwise protected against automated brute-force attacks, which specifically and heavily target WordPress's standard login URL
• File editing from within the WordPress admin is disabled where practical, so a compromised admin account can't be used to directly edit theme or plugin code
• User roles are assigned deliberately—most accounts don't need full administrator access, and the number of full admins is kept to the minimum genuinely required
• REST API and XML-RPC access are reviewed for whether they're actually needed as configured, since both are common attack vectors when left wide open unnecessarily

Backups

• Backups cover both the database (posts, pages, settings) and the files (uploads, theme, plugins), since a WordPress site needs both to actually be restorable
• Backups run automatically on a schedule matched to how often content changes, and are stored somewhere separate from the hosting account itself
• A restore has genuinely been tested, not just assumed to work because the backup file exists (see the security checklist)

Content & editorial workflow

• Editor accounts have access appropriate to their actual role, rather than everyone defaulting to administrator for convenience
• A consistent process exists for reviewing content before publishing, especially on multi-author sites
• Media library uploads are checked periodically for unused files bloating storage and slowing backups

Everything in the performance, security and maintenance checklists applies to WordPress sites too—this page covers what's genuinely additional, not a replacement for them.