{"id":21638,"date":"2020-02-13T20:48:19","date_gmt":"2020-02-13T20:48:19","guid":{"rendered":"https:\/\/www.process.st\/templates\/wordpress-security-audit-checklist-template\/"},"modified":"2024-05-16T06:31:13","modified_gmt":"2024-05-16T06:31:13","slug":"wordpress-security-audit-checklist-template","status":"publish","type":"post","link":"https:\/\/www.process.st\/templates\/wordpress-security-audit-checklist-template\/","title":{"rendered":"WordPress Security Audit Checklist Template"},"content":{"rendered":"\n<section id=\"introduction\">\n <h2>Introduction:<\/h2>\n <div class=\"image-content\">\n  <figure>\n   <a href=\"https:\/\/ps-attachments.s3.amazonaws.com\/c50522cc-2d5b-4d4b-9853-fb235ab6235f\/lQeaSH5gql6EVs0FQKdEQw.png\" alt=\"Introduction:\" target=\"_blank\" rel=\"noopener\"> <img decoding=\"async\" loading=\"lazy\" src=\"https:\/\/ps-attachments.s3.amazonaws.com\/c50522cc-2d5b-4d4b-9853-fb235ab6235f\/lQeaSH5gql6EVs0FQKdEQw.png\"> <\/a><!-- No caption -->\n  <\/figure>\n <\/div>\n <div class=\"text-content\">\n  <p>WordPress security maintenance is an essential measure to take in order to keep your company's sensitive information private. If WordPress accounts aren't managed properly and regularly, it can leave your site vulnerable to break-ins and compromise the state of your company.&nbsp;<\/p>\n  <p>Running a WordPress <a href=\"https:\/\/www.process.st\/checklist\/network-security-audit-checklist\/\" rel=\"nofollow noopener\" target=\"_blank\">security<\/a> audit allows you to prepare for and avoid any possible threats to your website. Though it's impossible to protect your website from every potential problem out there, it's certainly possible to prepare for some of the most common breach attempts by regularly auditing your site's security.<\/p>\n  <p>This is why we, at <a href=\"https:\/\/www.youtube.com\/watch?v=jtSUWKI6PNo\" rel=\"nofollow noopener\" target=\"_blank\">Process Street<\/a>, created this WordPress security audit checklist template, to offer a quick and easy process that can be <a href=\"https:\/\/www.process.st\/case-study-techmd\/\" rel=\"nofollow noopener\" target=\"_blank\">repeated<\/a> as often as necessary without the risk of overlooking any crucial steps and leave your website free of any vulnerabilities.<\/p>\n <\/div>\n<\/section>\n<section id=\"removealter-admin-user\">\n <h2>Remove\/alter \u201cadmin\u201d user<\/h2>\n <div class=\"text-content\">\n  <p>Are you or another administrative user on your site still using&nbsp;\"admin\"&nbsp;as their username? &nbsp;If so, the first thing you should do is remove or change them. &nbsp;<\/p>\n  <p>If someone is trying to gain access into your account, testing common usernames, like \"admin\", will be one of their first attempts.<\/p>\n  <p>So, just create a new user under a different name for the admin user, transfer all of their content over to their new account, and delete the old one.<\/p>\n <\/div>\n<\/section>\n<section id=\"change-default-passwords-to-strong-passwords-admin-users\">\n <h2>Change default passwords to strong passwords (admin users)<\/h2>\n <div class=\"text-content\">\n  <p>Make sure your <a href=\"https:\/\/www.process.st\/checklist\/privileged-password-management\/\" rel=\"nofollow noopener\" target=\"_blank\">passwords<\/a> are all difficult to guess.<\/p>\n  <p>They should:&nbsp;<\/p>\n <\/div>\n <div class=\"multi-select-content form-field-content\">\n  <div class=\"form-group\">\n   <label> (Subtasks) <\/label>\n  <\/div>\n  <ul class=\"items\">\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      1\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     be at least six characters long\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      2\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     use both lowercase and capital letters\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      3\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     use a combination of letters, numbers and special characters such as &lt;, } and ~. \u2013\n    <\/div><\/li>\n   <li class=\"item\">\n    <div class=\"step-number-container\">\n     <div class=\"step-number\">\n      4\n     <\/div>\n    <\/div>\n    <div class=\"step-checkbox-container\">\n     <div class=\"step-checkbox\"><\/div>\n    <\/div>\n    <div class=\"item-name-static\">\n     include misspelled words with special characters, such as \u201cL@Og&amp;NoE1$#8\u201d\n    <\/div><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"enable-wordpress-login-twofactor-authentication\">\n <h2>Enable WordPress login two-factor authentication<\/h2>\n <div class=\"text-content\">\n  <p>You should also consider enabling WordPress two-factor authentication.&nbsp;<a href=\"https:\/\/www.process.st\/enable-two-factor-authentication\/\" rel=\"nofollow noopener\" target=\"_blank\">Two-factor authentication<\/a> means that users would need to not only enter a password, but also to enter a code sent to the phone number or email that's attached to their account to get in.<\/p>\n  <p>So, if someone is trying to break into your account, they won\u2019t be be able to even if they're able to guess your password.&nbsp;<\/p>\n <\/div>\n<\/section>\n<section id=\"change-wordpress-salts-and-keys\">\n <h2>Change WordPress salts and keys<\/h2>\n <div class=\"text-content\">\n  <p>Make sure to check your wp-config.php file to see if you've changed your WordPress salts and keys.<\/p>\n  <p>Because WordPress uses cookies to verify logged in users and commenters on their sites, they added WordPress salt and keys to better protect private user information.&nbsp;<\/p>\n  <p>Changing your salt and keys should be a recurring step in your security audit process, and WordPress even offers a salt and keys auto-generator that's simple to use.<\/p>\n <\/div>\n<\/section>\n<section id=\"update-wordpress-plugins-and-themes-to-latest-version\">\n <h2>Update WordPress plugins and themes to latest version<\/h2>\n <div class=\"text-content\">\n  <p>Make sure to check if all of your WordPress plugins and themes are up-to-date.<\/p>\n  <p>WordPress version updates usually include security fixes and improvements and if you\u2019re still running older versions, you run the risk of version's security issues being exploited.<\/p>\n <\/div>\n<\/section>\n<section id=\"remove-any-inactive-users\">\n <h2>Remove any inactive users<\/h2>\n <div class=\"text-content\">\n  <p>Ensure that any inactive users on your site are removed. These abandoned users can also be exploited to breach your site.<\/p>\n <\/div>\n<\/section>\n<section id=\"establish-strong-wordpress-backup-strategy\">\n <h2>Establish strong WordPress backup strategy<\/h2>\n <div class=\"text-content\">\n  <p>There's always a possibility that something can happen to your site, no matter how secure it may be.<\/p>\n  <p>That's why it's important to have a backup solution as part of your WordPress Security Audit Checklist.<\/p>\n  <p>You should consider using a WordPress backup plugin to quickly save your site in its entirety if the worst were to happen.<\/p>\n <\/div>\n<\/section>\n<section id=\"approval-final-approval-content-manager\">\n <h2>Approval: Final Approval (Content Manager)<\/h2>\n <div class=\"approval-content\">\n  <div class=\"header\">\n   <div class=\"list-title\">\n    Will be submitted for approval:\n   <\/div>\n  <\/div>\n  <div class=\"approval-rule-subject-tasks-list\">\n   <ul class=\"list\">\n    <li>\n     <div class=\"approval-rule-subject-tasks-list-item\">\n      <div class=\"item\">\n       <div class=\"container\">\n        <span class=\"title\">Remove\/alter \u201cadmin\u201d user<\/span>\n        <div class=\"body\">\n         Will be submitted\n        <\/div>\n       <\/div>\n      <\/div>\n     <\/div><\/li>\n    <li>\n     <div class=\"approval-rule-subject-tasks-list-item\">\n      <div class=\"item\">\n       <div class=\"container\">\n        <span class=\"title\">Change default passwords to strong passwords (admin users)<\/span>\n        <div class=\"body\">\n         Will be submitted\n        <\/div>\n       <\/div>\n      <\/div>\n     <\/div><\/li>\n    <li>\n     <div class=\"approval-rule-subject-tasks-list-item\">\n      <div class=\"item\">\n       <div class=\"container\">\n        <span class=\"title\">Enable WordPress login two-factor authentication<\/span>\n        <div class=\"body\">\n         Will be submitted\n        <\/div>\n       <\/div>\n      <\/div>\n     <\/div><\/li>\n    <li>\n     <div class=\"approval-rule-subject-tasks-list-item\">\n      <div class=\"item\">\n       <div class=\"container\">\n        <span class=\"title\">Change WordPress salts and keys<\/span>\n        <div class=\"body\">\n         Will be submitted\n        <\/div>\n       <\/div>\n      <\/div>\n     <\/div><\/li>\n    <li>\n     <div class=\"approval-rule-subject-tasks-list-item\">\n      <div class=\"item\">\n       <div class=\"container\">\n        <span class=\"title\">Update WordPress plugins and themes to latest version<\/span>\n        <div class=\"body\">\n         Will be submitted\n        <\/div>\n       <\/div>\n      <\/div>\n     <\/div><\/li>\n    <li>\n     <div class=\"approval-rule-subject-tasks-list-item\">\n      <div class=\"item\">\n       <div class=\"container\">\n        <span class=\"title\">Remove any inactive users<\/span>\n        <div class=\"body\">\n         Will be submitted\n        <\/div>\n       <\/div>\n      <\/div>\n     <\/div><\/li>\n    <li>\n     <div class=\"approval-rule-subject-tasks-list-item\">\n      <div class=\"item\">\n       <div class=\"container\">\n        <span class=\"title\">Establish strong WordPress backup strategy<\/span>\n        <div class=\"body\">\n         Will be submitted\n        <\/div>\n       <\/div>\n      <\/div>\n     <\/div><\/li>\n   <\/ul>\n  <\/div>\n <\/div>\n<\/section>\n<section id=\"sources\">\n <h2>Sources:<\/h2>\n <div class=\"text-content\">\n  <ul>\n   <li><a href=\"http:\/\/www.dotnetfunda.com\/\" rel=\"nofollow noopener\" target=\"_blank\">dotnetfunda<\/a>&nbsp;-&nbsp;<a href=\"http:\/\/www.dotnetfunda.com\/articles\/show\/1083\/restricting-user-to-login-multiple-times-using-same-credentials\" rel=\"nofollow noopener\" target=\"_blank\">Restricting Use To Login Multiple Times Using Same Credentials<\/a><\/li>\n   <li><a href=\"http:\/\/geekswithblogs.net\/\" rel=\"nofollow noopener\" target=\"_blank\">geekswithblogs<\/a>&nbsp;-&nbsp;<a href=\"http:\/\/geekswithblogs.net\/Frez\/articles\/preventing-a-user-from-having-multiple-concurrent-sessions.aspx\" rel=\"nofollow noopener\" target=\"_blank\" title=\"Title of this entry.\">Preventing a User From Having Multiple Concurrent Sessions<\/a><\/li>\n   <li><a href=\"https:\/\/www.codeproject.com\/\" rel=\"nofollow noopener\" target=\"_blank\">codeproject<\/a>&nbsp;-&nbsp;<a href=\"https:\/\/www.codeproject.com\/Questions\/410002\/How-to-avoid-multi-user-signin-using-same-credenti\" rel=\"nofollow noopener\" target=\"_blank\">How To Avoid Multi-User Sign-In Using Same Credentials<\/a><\/li>\n   <li><a href=\"https:\/\/securitywing.com\/\" rel=\"nofollow noopener\" target=\"_blank\">securitywing<\/a>&nbsp;-&nbsp;<a href=\"https:\/\/securitywing.com\/63-web-application-security-checklist-auditors-developers\/\" rel=\"nofollow noopener\" target=\"_blank\">63 Web Application Security Checklist for IT Security Auditors and Developers<\/a><\/li>\n   <li><a href=\"https:\/\/searchenterprisedesktop.techtarget.com\/\" rel=\"nofollow noopener\" target=\"_blank\">searchenterprisedesktop<\/a>&nbsp;-&nbsp;<a href=\"https:\/\/searchenterprisedesktop.techtarget.com\/tip\/Enterprise-password-protection-checklist\" rel=\"nofollow noopener\" target=\"_blank\">Enterprise password protection checklist<\/a><\/li>\n   <li><a href=\"https:\/\/www.cmu.edu\/\" rel=\"nofollow noopener\" target=\"_blank\">cmu<\/a>&nbsp;-&nbsp;<a href=\"https:\/\/www.cmu.edu\/iso\/governance\/guidelines\/password-management.html\" rel=\"nofollow noopener\" target=\"_blank\">Guidelines for Password Management<\/a><\/li>\n   <li><a href=\"https:\/\/thycotic.com\/\" rel=\"nofollow noopener\" target=\"_blank\">thycotic<\/a>&nbsp;-&nbsp;<a href=\"https:\/\/thycotic.com\/company\/blog\/2019\/01\/01\/future-of-passwords-enterprise\/\" rel=\"nofollow noopener\" target=\"_blank\">Password Management Practices in the Enterprise and the Future of Passwords<\/a><\/li>\n   <li><a href=\"https:\/\/www.vxchnge.com\/\" rel=\"nofollow noopener\" target=\"_blank\">vxchnge<\/a>&nbsp;-&nbsp;<a href=\"https:\/\/www.vxchnge.com\/blog\/enterprise-password-management\" rel=\"nofollow noopener\" target=\"_blank\">[Guide] How To Choose the Best Enterprise Password Management Solution<\/a><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n<section id=\"related-checklists\">\n <h2>Related checklists:<\/h2>\n <div class=\"text-content\">\n  <ul>\n   <li><a href=\"https:\/\/process.st\/checklist\/invoice-approval-workflow-checklist-template\" rel=\"nofollow noopener\" target=\"_blank\">Invoice Approval Workflow Checklist Template<\/a><\/li>\n   <li><a href=\"https:\/\/process.st\/checklist\/blog-content-approval-checklist-template\" rel=\"nofollow noopener\" target=\"_blank\">Blog Content Approval Checklist Template<\/a><\/li>\n   <li><a href=\"https:\/\/process.st\/checklist\/graphic-design-approval-checklist-template\" rel=\"nofollow noopener\" target=\"_blank\">Graphic Design Approval Checklist Template<\/a><\/li>\n   <li><a href=\"https:\/\/process.st\/checklist\/video-content-approval-workflow-checklist-template\" rel=\"nofollow noopener\" target=\"_blank\">Video Content Approval Workflow Checklist Template<\/a><\/li>\n   <li><a href=\"https:\/\/process.st\/checklist\/information-security-checklist-template\" rel=\"nofollow noopener\" target=\"_blank\">Information Security Checklist Template<\/a><\/li>\n   <li><a href=\"https:\/\/process.st\/checklist\/application-security-audit-checklist-template\" rel=\"nofollow noopener\" target=\"_blank\">Application Security Audit Checklist Template<\/a><\/li>\n   <li><a href=\"https:\/\/process.st\/checklist\/content-marketing-workflow-management-checklist-template\" rel=\"nofollow noopener\" target=\"_blank\">Content Marketing Workflow Management Checklist Template<\/a><\/li>\n   <li><a href=\"https:\/\/process.st\/checklist\/enterprise-password-management-checklist-template\" rel=\"nofollow noopener\" target=\"_blank\">Enterprise Password Management Checklist Template<\/a><\/li>\n   <li><a href=\"https:\/\/process.st\/checklist\/enterprise-video-content-management-checklist\" rel=\"nofollow noopener\" target=\"_blank\">Enterprise Video Content Management Checklist<\/a><\/li>\n  <\/ul>\n <\/div>\n<\/section>\n","protected":false},"excerpt":{"rendered":"<p>Introduction: WordPress security maintenance is an essential measure to take in order to keep your company's sensitive information private. If WordPress accounts aren't managed properly and regularly, it can leave your site vulnerable to break-ins and compromise the state of your company.&nbsp; Running a WordPress security audit allows you to prepare for and avoid any [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":21639,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"ep_exclude_from_search":false,"cover_icon_emoji":"\ud83d\udd13","cover_icon_url":"","tasks_count":"11","template_description":"Run this checklist whenever you need to manage WordPress security.","template_id":"kApGOYdunKBkCt-0m5NKPQ","task_0":"Introduction:","task_slug_0":"introduction","task_1":"Remove\/alter \u201cadmin\u201d user","task_slug_1":"removealter-admin-user","task_2":"Change default passwords to strong passwords (admin users)","task_slug_2":"change-default-passwords-to-strong-passwords-admin-users","task_3":"Enable WordPress login two-factor authentication","task_slug_3":"enable-wordpress-login-twofactor-authentication","task_4":"Change WordPress salts and keys","task_slug_4":"change-wordpress-salts-and-keys","task_5":"Update WordPress plugins and themes to latest version","task_slug_5":"update-wordpress-plugins-and-themes-to-latest-version","task_6":"Remove any inactive users","task_slug_6":"remove-any-inactive-users","task_7":"Establish strong WordPress backup strategy","task_slug_7":"establish-strong-wordpress-backup-strategy","task_8":"Approval: Final Approval (Content Manager)","task_slug_8":"approval-final-approval-content-manager","task_9":"Sources:","task_slug_9":"sources","task_10":"Related checklists:","task_slug_10":"related-checklists","task_11":"","task_slug_11":"","task_12":"","task_slug_12":"","task_13":"","task_slug_13":"","task_14":"","task_slug_14":"","task_15":"","task_slug_15":"","task_16":"","task_slug_16":"","task_17":"","task_slug_17":"","task_18":"","task_slug_18":"","task_19":"","task_slug_19":"","task_20":"","task_slug_20":"","task_21":"","task_slug_21":"","task_22":"","task_slug_22":"","task_23":"","task_slug_23":"","task_24":"","task_slug_24":"","task_25":"","task_slug_25":"","task_26":"","task_slug_26":"","task_27":"","task_slug_27":"","task_28":"","task_slug_28":"","task_29":"","task_slug_29":"","task_30":"","task_slug_30":"","task_31":"","task_slug_31":"","task_32":"","task_slug_32":"","task_33":"","task_slug_33":"","task_34":"","task_slug_34":"","task_35":"","task_slug_35":"","task_36":"","task_slug_36":"","task_37":"","task_slug_37":"","task_38":"","task_slug_38":"","task_39":"","task_slug_39":"","task_40":"","task_slug_40":"","task_41":"","task_slug_41":"","task_42":"","task_slug_42":"","task_43":"","task_slug_43":"","task_44":"","task_slug_44":"","task_45":"","task_slug_45":"","task_46":"","task_slug_46":"","task_47":"","task_slug_47":"","task_48":"","task_slug_48":"","task_49":"","task_slug_49":"","task_50":"","task_slug_50":"","task_51":"","task_slug_51":"","task_52":"","task_slug_52":"","task_53":"","task_slug_53":"","task_54":"","task_slug_54":"","task_55":"","task_slug_55":"","task_56":"","task_slug_56":"","task_57":"","task_slug_57":"","task_58":"","task_slug_58":"","task_59":"","task_slug_59":"","task_60":"","task_slug_60":"","task_61":"","task_slug_61":"","task_62":"","task_slug_62":"","task_63":"","task_slug_63":"","task_64":"","task_slug_64":"","task_65":"","task_slug_65":"","task_66":"","task_slug_66":"","task_67":"","task_slug_67":"","task_68":"","task_slug_68":"","task_69":"","task_slug_69":"","task_70":"","task_slug_70":"","task_71":"","task_slug_71":"","task_72":"","task_slug_72":"","task_73":"","task_slug_73":"","task_74":"","task_slug_74":"","task_75":"","task_slug_75":"","task_76":"","task_slug_76":"","task_77":"","task_slug_77":"","task_78":"","task_slug_78":"","task_79":"","task_slug_79":"","task_80":"","task_slug_80":"","task_81":"","task_slug_81":"","task_82":"","task_slug_82":"","task_83":"","task_slug_83":"","task_84":"","task_slug_84":"","task_85":"","task_slug_85":"","task_86":"","task_slug_86":"","task_87":"","task_slug_87":"","task_88":"","task_slug_88":"","task_89":"","task_slug_89":"","task_90":"","task_slug_90":"","task_91":"","task_slug_91":"","task_92":"","task_slug_92":"","task_93":"","task_slug_93":"","task_94":"","task_slug_94":"","task_95":"","task_slug_95":"","task_96":"","task_slug_96":"","task_97":"","task_slug_97":"","task_98":"","task_slug_98":"","task_99":"","task_slug_99":"","footnotes":""},"categories":[60,57],"tags":[],"class_list":["post-21638","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-creative-workflow-management","category-information-security"],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/21638","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/comments?post=21638"}],"version-history":[{"count":0,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/posts\/21638\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/media\/21639"}],"wp:attachment":[{"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/media?parent=21638"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/categories?post=21638"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.process.st\/templates\/wp-json\/wp\/v2\/tags?post=21638"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}