WordPress security checklist

Print this and tick it after a cleanup, or before a site is attacked. It is not a malware scan.

• Core, plugins, and themes update from WordPress.org or the vendor. Nothing nulled.
• Unused plugins and themes are deleted, not only deactivated.
• Every admin is someone you know. Extra admins are removed.
• Passwords are unique. The database salts in wp-config.php were regenerated if the site was hacked.
• SFTP, hosting panel, and registrar use their own passwords and two-factor where the vendor offers it.
• The uploads directory does not execute PHP.
• A backup exists off the same server, and you have restored it once as a test.
• Search Console has no open security issue.