WordPress Malware Protection Checklist: Everything You Need to Do

Question

If your WordPress site went down tomorrow because a hacker injected malicious code, redirected your visitors to a phishing page, or got your domain blocked by Google, how quickly could you recover, and more importantly, could you have stopped it? WordPress powers over 43% of the web, making it the most targeted CMS for automated attacks, brute-force bots, and supply-chain malware delivered through outdated plugins. Most site owners think about security only after a breach. This checklist changes that.

Why WordPress Sites Get Infected (And Why “Just Keep It Updated” Is Not Enough)

The common advice is to keep WordPress, themes, and plugins updated. That is correct but incomplete. The majority of WordPress malware infections happen through three specific vectors:

• Compromised plugins and themes: especially nulled (pirated) versions that ship with backdoors baked in. Even legitimate plugins can carry vulnerabilities for weeks before a patch ships.
• Weak credentials and no login throttling: WordPress’s default login URL (/wp-login.php) is publicly known. Without brute-force protection, automated bots can cycle through thousands of username-password combinations with no friction.
• Outdated PHP and server software: WordPress running on PHP 7.4 or below is exposed to vulnerabilities that have long been patched in PHP 8.1+. Your host’s server stack matters as much as WordPress itself.

Understanding where infections enter is what makes a checklist like this actionable rather than decorative.

The WordPress Malware Protection Checklist

1. Harden Your Login Page

The default WordPress login sits at /wp-login.php. Every bot on the internet knows this. Your first move is to reduce the attack surface at the point of entry.

• Change the login URL using a plugin like WPS Hide Login. This removes your site from automated mass-scan targeting.
• Enable two-factor authentication (2FA) for all admin and editor accounts. Wordfence, miniOrange, and WP 2FA handle this well.
• Limit login attempts using Limit Login Attempts Reloaded. Lock accounts after 3 to 5 failed tries.
• Disable XML-RPC if you do not use it. It is a legacy endpoint that attackers abuse for credential stuffing.

2. Audit and Control Your Plugins and Themes

Every plugin is an extension of trust. The more plugins you run, the wider your attack surface.

• Remove inactive plugins and themes immediately. Even deactivated plugins can be exploited if they remain on the server.
• Only install from the official WordPress.org repository or reputable commercial marketplaces. Never install nulled plugins.
• Check plugin update frequency and active install counts before installing. A plugin with no updates in 18 months is a risk.
• Use WPScan or Patchstack to audit installed plugins against known vulnerability databases.

⚠️ Never Use Nulled Plugins

Nulled (pirated) plugins are one of the most reliable ways to get your site infected. They frequently contain backdoors baked in by the distributor. The $40 plugin license is not worth gambling your entire site over.

3. Set Correct File Permissions

Incorrect file permissions are one of the most overlooked hardening steps. WordPress files should not be world-writable.

The correct permission structure: Files 644 | Directories 755 | wp-config.php 440 or 400

# Set correct permissions for all files
find /path/to/wordpress/ -type f -exec chmod 644 {} \;

# Set correct permissions for all directories
find /path/to/wordpress/ -type d -exec chmod 755 {} \;

# Lock down wp-config.php
chmod 440 wp-config.php

Also disable file editing from the WordPress admin panel by adding this to wp-config.php:

// Prevent admin file editor access
define('DISALLOW_FILE_EDIT', true);

4. Protect wp-config.php and Sensitive Files

wp-config.php contains your database credentials, secret keys, and table prefix. Block direct access via .htaccess:

# Block direct access to wp-config.php
<files wp-config.php>
  order allow,deny
  deny from all
</files>

# Block XML-RPC if unused
<files xmlrpc.php>
  order allow,deny
  deny from all
</files>

# Hide WordPress version from readme
<files readme.html>
  order allow,deny
  deny from all
</files>

5. Move wp-config.php One Level Up

WordPress automatically looks for wp-config.php one directory above the web root. Moving it there keeps it completely outside the publicly accessible file structure; zero plugins needed, maximum effect.

✅ Pro Tip: Simply move the file to the parent directory of your public_html or www folder via FTP/SFTP. WordPress will find it automatically. No config change required.

6. Install a WordPress Security Plugin (And Configure It Properly)

A security plugin is not a magic shield, but it gives you active monitoring, firewall rules, and malware scanning in one place. For websites that need more hands-on protection, WordPress malware protection services can also provide professional monitoring, malware cleanup, and ongoing security support. The three most widely trusted options:

• Wordfence Security: includes a web application firewall (WAF), malware scanner, real-time traffic monitoring, and login protection. The free version is solid; the paid version gets real-time firewall rule updates.
• Sucuri Security: strong on server-side scanning and blocklist monitoring. Pairs well with their CDN/WAF service if you want cloudside filtering.
• iThemes Security (now Solid Security): good for non-technical users who want guided hardening steps.

Whichever you choose, configure it. Default settings don't provide maximum protection. Enable the firewall in “enforced” mode, schedule daily scans, and set up email alerts for critical events.

7. Run Regular Malware Scans

• Run Wordfence or MalCare scans at least weekly.
• Use Sucuri SiteCheck (free, online) to cross-reference against Google Safe Browsing, McAfee, and Norton blacklists.
• On VPS/dedicated hosting, run ClamAV for filesystem-level scanning that plugin scanners cannot reach.

8. Use HTTPS and Force SSL Everywhere

Force HTTPS across your entire site with this .htaccess rule, then lock down the admin area in wp-config.php:

# Force HTTPS on all requests
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

// Force SSL for the admin dashboard
define('FORCE_SSL_ADMIN', true);

9. Implement HTTP Security Headers

Security headers tell browsers how to handle your site’s content. They prevent a class of attacks including cross-site scripting (XSS), clickjacking, and MIME-type sniffing.
Add these to .htaccess:

# Prevent clickjacking
Header always set X-Frame-Options "SAMEORIGIN"

# Prevent MIME-type sniffing
Header always set X-Content-Type-Options "nosniff"

# Enable XSS filtering in older browsers
Header always set X-XSS-Protection "1; mode=block"

# Control referrer information
Header always set Referrer-Policy "strict-origin-when-cross-origin"

# Restrict browser features
Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"

💡 Test Your Headers: After adding these, test at securityheaders.com for an instant grade and any missing headers your server is not sending.

10. Change the Default Database Table Prefix

WordPress installs with wp_ as the default database table prefix. SQL injection attacks target this predictable naming. During a fresh install, change it to something like xk72m_ in wp-config.php:

// Change from default 'wp_' to a random prefix
$table_prefix = 'xk72m_';

⚠️ Existing Sites: Changing the prefix on a live site requires updating every table in your database. Use the Brozzme DB Prefix plugin and always take a full backup before proceeding.

11. Create Automated, Offsite Backups

Backups are not a malware prevention tool, but they are your recovery mechanism when everything else fails. You can recover an infected site with a clean backup in under an hour. An infected site without a backup is a crisis.

• Use UpdraftPlus, BlogVault, or WPvivid to schedule automated backups.
• Store backups offsite: Amazon S3, Google Drive, Dropbox, or a remote FTP. Never store backups only on the same server your site lives on.
• Test your restore process at least once. A backup you have never restored is a backup you cannot trust.

12. Keep Everything Updated on a Schedule

PHP, WordPress core, themes, and plugins; all of it, weekly. Enable automatic minor core updates in wp-config.php:

// Enable automatic minor WordPress core updates
define('WP_AUTO_UPDATE_CORE', 'minor');

// Optional: disable all auto-updates (use with a manual update process)
// define('AUTOMATIC_UPDATER_DISABLED', true);

What to Do If Your WordPress Site Is Already Infected

If you suspect your site has been compromised, act in this order:

• Take the site offline or put it in maintenance mode to stop the spread and protect visitors.
• Scan with Wordfence or MalCare to identify infected files.
• Restore from a clean backup if you have one and know when the infection occurred.
• If no clean backup exists, use a professional malware removal service (Sucuri, Wordfence Care, or WP Buffs) rather than trying to clean every file manually.
• Change all passwords: WordPress admin accounts, database password, FTP/SFTP credentials, and hosting panel login.
• Request Google blocklist removal via Google Search Console once the site is clean.

🚨 Do Not Skip Step 5: If an attacker had admin access, they likely created backdoor accounts or stored credentials. Cleaning files without rotating all passwords leaves the door open for re-infection within hours.

Conclusion

WordPress malware protection is not a one-time setup. It is a layered, ongoing process: harden the login, audit your plugins, set correct permissions, run regular scans, enforce HTTPS, and back up consistently. None of these steps alone guarantees safety, but together they make your site a significantly harder target than most WordPress installations on the web. Attackers follow the path of least resistance. Make sure your site is not it.

Frequently Asked Questions

How do I know if my WordPress site has malware?

Common signs include unexpected redirects to unknown sites, new admin users you did not create, Google Search Console warnings about harmful content, your hosting provider suspending your account, or visitors reporting security warnings in their browsers. Run a scan with Wordfence or check your site with Sucuri SiteCheck for a fast, free diagnosis.

What is the best plugin to protect WordPress from malware?

Wordfence Security is the most widely used option and offers a strong firewall, malware scanner, and login protection in its free tier. Sucuri Security is preferred when you also want cloudside WAF filtering. MalCare is a good choice if you want automated daily scanning with one-click malware removal. The best plugin is whichever one you actually configure and monitor.

How often should I scan my WordPress site for malware?

At minimum, once a week. If you run an ecommerce store or handle sensitive user data, daily scanning is worth the overhead. Most security plugins let you schedule automated scans, so there is little reason to scan less frequently. Also scan immediately after installing a new plugin, after a WordPress core update, or if you notice unusual traffic or behavior.

Can malware infect WordPress through plugins?

Yes, and this is one of the most common infection vectors. Plugins can carry vulnerabilities that attackers exploit to inject malicious code. Nulled (pirated) plugins frequently contain backdoors by design. Even legitimate plugins from reputable developers can have unpatched security flaws. Use Patchstack or WPScan to monitor your installed plugins against known vulnerability databases.

Does updating WordPress remove malware?

No. Updating WordPress patches known software vulnerabilities but does not remove existing malware from your files or database. If your site is already infected, scan and clean it first, then update. Updating an infected site may close the entry point, but the malicious code already present will remain until you explicitly remove it.