WordPress Website Security Verification Checklist

1. Enable chattr on public_html, exclude /uploads if needed 2. Enable database triggers on the table wp_users 3. Remove suspicious/unauthorized admin users from table wp_users 4. Install 2Factor authentication on wp-admin 5. Ask hosting service provider to Imunify the website 6. Verify wordpress core checksum files under public_html 7. Review & Remove Suspicious, Vulnerable, or Unnecessary WordPress Plugins 8. Verify and remove suspicious/unwanted themes 9. Check mu-plugins for any suspicious file(s) 10. Disable new plugins installation if possible 11. Change cpanel/wp-admin credentials after a confirmed compromise 12. Rename wordpress default admin username 13. Verify index.php file for suspicious code 14. Verify wp-config.php for suspicious code 15. Verify .htaccess files for suspicious rules 16. Check uploads directory for PHP/executable files 17. Check recently modified website files 18. Verify hosting account cron jobs 19. Verify wordpress, plugins and themes are updated 20. Keep the latest PHP version 21. Review website access and error logs 22. Disable or restrict XML-RPC if not required 23. Regenerate wordpress security keys and salts 24. Remove all WordPress Admin Login sessions 25. Change All WordPress Administrator Passwords After Security Hardening 26. Change the cPanel Account Password After Security Hardening