Quick answer: Work through this checklist top to bottom — server, then WordPress, then habits. Each line links to the full guide. A site that ticks every box is out of reach of the automated attacks that compromise most WordPress installs.
Overview
This is the condensed, printable counterpart to securing WordPress on a VPS: every item in one place, ordered by impact. Use it on every new site and as a quarterly audit for existing ones.
Before you start
- Root/sudo access to the VPS and admin access to WordPress.
- Half an hour for a new site; an hour for auditing an old one.
Step-by-step guide
Server layer (details: VPS hardening):
- ☐ SSH by key only, root password login disabled.
- ☐ Firewall active — only 22, 80, 443 (and panel port, IP-restricted) open (UFW).
- ☐ Automatic security updates on (
unattended-upgrades). - ☐ fail2ban running for SSH and WordPress logins (setup).
WordPress layer:
- ☐ Core, themes, plugins current; auto-updates for trusted plugins.
- ☐ No inactive themes/plugins; nothing nulled/pirated, ever.
- ☐ Unique admin usernames + strong passwords + 2FA for all admins.
- ☐ Permissions: dirs 755 / files 644 / wp-config.php 640;
DISALLOW_FILE_EDITset. - ☐
xmlrpc.phpblocked if unused; login attempts limited. - ☐ Security plugin scanning (Wordfence or similar);
wp core verify-checksumsscheduled. - ☐ SSL valid and auto-renewing, HTTP redirected (SSL guide).
Habits:
- ☐ Offsite backups running and restore-tested this quarter.
- ☐ Updates tested on staging for business-critical sites.
- ☐ Admin accounts reviewed quarterly; departed users removed.
Common issues
- Checklist done once, never repeated: drift is real — calendar a quarterly pass.
- All app, no server: a hardened WordPress on an open VPS is still compromised via SSH or the panel.
- Backups assumed, not tested: an untested backup is a hope, not a control.
When to contact support
Suspect a compromise despite the checklist — strange admin users, unexplained files, traffic spikes? Preserve the evidence and open a ticket; the team can assist at the platform level while you remediate the application.
Frequently asked questions
How often should I run through the security checklist?
Fully on every new site, then quarterly as an audit — permissions drift, plugins get abandoned and admin lists grow stale faster than most owners expect.
What are the three highest-impact items on the list?
Keeping everything updated, enforcing 2FA with strong unique passwords, and tested offsite backups — those three neutralize or undo the vast majority of real-world attacks.
Is a security plugin alone enough protection?
No — it covers the application layer only. Without SSH keys, a firewall and OS updates underneath, the server around WordPress remains the easier way in.
Related articles
- How to secure WordPress on a VPS
- How to protect WordPress from brute-force attacks
- How to secure your VPS after deployment
- How to configure WordPress backups
Need a hand? Contact Cloud2Y support →
