WordPress Security: The 10-Minute Monthly Checklist That Catches Real Problems

Security that depends on remembering to do something big and occasional doesn’t happen. A short, fixed routine you can finish on a Monday morning does. This is the monthly check I’d run on any WordPress site, in the order that finds problems fastest. It takes about ten minutes on one site, and the WP-CLI parts can be looped across many.

If you haven’t hardened the site yet, start with the hardening checklist first — this routine is for keeping a hardened site honest. The screens and commands named below are from Loyal Security, the free plugin from WordPress.org.

Minute 1: Read the score and the status

Start with the summary, so you know where to look. The admin-bar Security Score gives an A–F grade; from a terminal:

wp loyal-security status

A grade that dropped since last month means a setting changed, a feature was turned off, or something new needs attention. That tells you which of the next steps matter most.

Minutes 2–3: Updates and known vulnerabilities

wp core check-update
wp plugin list --update=available
wp theme list --update=available

Then open the Plugins screen: Loyal Security flags installed plugins and themes with known CVEs inline, so you can tell “an update is available” from “an update is available and the old version is known-exploitable“. Update the second kind first. While you’re there, delete anything inactive, and replace anything abandoned — no update in a couple of years is a finding by itself.

Minute 4: Who has admin?

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered

Every name should be someone you recognise who still needs the access. An account you can’t account for, or one registered recently with no explanation, is the single most important thing this routine can find. The database scanner also flags rogue administrator accounts, so a clean result in both places is reassuring.

Minutes 5–6: Skim the audit log and live traffic

Open the audit log and filter to the last 30 days. You’re not reading everything, you’re looking for shapes:

• Successful logins from places or times that don’t fit your users.
• A burst of failed logins followed by a success.
• Plugins or themes installed, activated or edited that nobody on the team admits to.
• Settings changes to security features.

The log records IP, user and proxy information and keeps 90 days by default, so a month-over-month look always has data. The Live Traffic view is worth thirty seconds too: it classifies user agents and lets you block or unblock an address in one click. Background on what to record: Auditing WordPress Changes.

Minute 7: File integrity

wp core verify-checksums
wp plugin verify-checksums --all

These verify core and WordPress.org plugins against published checksums. Loyal Security’s integrity monitoring does the same and adds baseline diffing for themes, mu-plugins and drop-ins — the places the WP-CLI commands can’t see. Any unexpected change is worth a look: either you deployed something (fine, know what) or something wrote to your files (not fine).

Minute 8: Last scans

Confirm the weekly automatic malware scan actually ran and see what it said. If it didn’t, or you want a fresh result after updates:

wp loyal-security scan

Run the database scan as well — it checks posts, page-builder content, comments, options, user meta and snippet plugins for injected scripts, external script sources, spam links and a changed site address. Malware that lives only in the database is invisible to a file scanner, and it’s a common place for SEO spam to hide.

Anything flagged goes to quarantine rather than straight to deletion, so a false positive is recoverable; the one-click clean-file recovery restores a known-good copy of a core or plugin file.

Minute 9: Backups, including the one that matters

• Is the newest backup recent, and is the schedule still on?
• Is a copy stored off this server?
• When did you last restore one? Once a quarter, restore to staging and confirm the site works.

Loyal Security can also produce a downloadable recovery tool for restoring even when WordPress won’t load; check you still have it and that it matches the current backups. wp loyal-security backup will take a fresh one if the last is stale.

Minute 10: Alerts, 2FA, and one change

Confirm email alerts still reach a mailbox someone reads — alerts that go to a departed employee are the same as no alerts. Check each privileged account still has two-factor on. Then pick one thing from this month’s findings and fix it right now; a checklist that only produces a to-do list doesn’t improve anything.

Keep a record

Write one line per month: date, score, anything found, what you changed. After three months the pattern shows you what keeps recurring — usually the same neglected plugin or the same user who won’t turn on 2FA — and that is where to spend effort.

Doing this across many sites

The WP-CLI half loops easily over SSH, and capturing wp loyal-security status output and diffing it against last month’s turns “check twelve sites” into “look at the ones that changed” (the pattern is in WP-CLI for Security Housekeeping). If you manage enough sites that even that is a chore, the separate Pro plugin adds a multi-site hub, white-label reporting and automation — details on the Pro page. Everything in the routine above works with the free plugin alone.