There are heaps of tutorials explaining how to secure a WordPress installation, but I couldn't find any that listed out steps for weekly or monthly security checks. What are some steps that you recommend I perform on a regular basis to keep WordPress secure (besides updating core and plugins)?
Here are some things I've implemented already:
- Forced all other users to only run as Editor
- Deleted unused themes and plugins
- My theme is custom written, so I know that there aren't any scripts like
timthumb.phpin it. It's also powered by Genesis which features automatic theme updates.
- Change my admin password every few months
- Automatic backups with VaultPress
The main reason why I'm concerned is because my client's hosting provider is not very WordPress friendly and I have to run with 777 permissions. However my client is the only site on the box.
Anything else I should be doing regularly to make sure the site is locked down? Thanks