◈Section 3 of 6
Complete SOP Task Reference
Full catalog of all 64 security checklist tasks organized across 7 agency SOP sections.
Catalog of All 64 SOP Tasks
The checklist is structured around our agency security SOP, organized across 7 distinct sections and 4 operational levels:
Level A: Safe AutomationLevel B: Guided BridgesLevel C: SOP RemindersLevel D: Client Reports
Security Update (5 Tasks)
Core security patches, automatic update policies, and foundational protection.
| Level | Task | Description |
|---|---|---|
| L-A | Verify Recent Site Backup | Verifies that a full database & file backup exists within the last 24–48 hours (UpdraftPlus, WPvivid, or host snapshot). |
| L-A | Disable Automatic Updates | Prevents unverified background core, plugin, and theme updates from breaking client customizations. Agency manages updates manually. |
| L-B | Wordfence Firewall & Scanner | Verifies Wordfence WAF status, brute-force lockout rules, and alert preferences against the agency SOP. |
| L-B | Enforce Two-Factor Authentication (2FA) | Ensures an active 2FA plugin is installed and mandatory for all administrator accounts. |
| L-A | Scan Vulnerability Database (Patchstack CVE) | Cross-references installed plugins and themes against the Patchstack vulnerability database with match-confidence scoring. Cached 24h. |
General Check (21 Tasks)
Environment audit, rogue admin detection, database integrity, and file scans.
| Level | Task | Description |
|---|---|---|
| L-A | Environment Audit (PHP, WP, SSL) | Audits PHP version (>= 8.1), WordPress core release, and SSL certificate expiration window. |
| L-A | Detect Rogue / Unrecognized Admins | Compares administrator users against the accepted baseline snapshot taken at activation. Alerts on any newly created or altered admin. |
| L-A | wp_options Integrity & Autoload Scan | Checks for siteurl/home URL hijacking and flags oversized autoloaded options (>100KB) that cause database slowdowns or malware persistence. |
| L-A | Audit Must-Use (mu-plugins) Directory | Inspects wp-content/mu-plugins for unauthorized PHP scripts that execute automatically outside standard plugin controls. |
| L-A | Scan Exposed Backups & Dumps in Webroot | Scans for public database dumps (*.sql), .env files, and wp-config backups accidentally left in the public webroot. |
| L-A | Detect & Quarantine Risky Plugins | Detects leftover migration tools (Better Search Replace, File Manager, Duplicate Page). Deleting zips the plugin first to enable real Undo. |
| L-A | Scan Closed / Abandoned Plugins (WP.org) | Checks installed public plugins against the WordPress.org API to detect plugins removed for security vulnerabilities. Cached 24h. |
| L-B | Custom Child Theme Setup | Verifies if a child theme is active. Generates a clean child theme without third-party online generators. |
| L-A | File Permissions Audit (wp-config 640, 644/755) | Audits key files and directories against strict permission baselines (wp-config.php <= 0640, root files <= 0644, directories <= 0755) and flags world-writable bits. |
| L-A | PHP Security Restrictions (disable_functions & open_basedir) | Audits php.ini to detect if dangerous execution functions (exec, shell_exec, system, passthru) are disabled and whether open_basedir is active. |
| L-A | Database Table Prefix Detection | Checks whether database tables use the default "wp_" prefix or a custom prefix to resist automated SQL injection scripts. |
| L-A | TLS Protocol & Certificate Chain Depth Probe | Actively probes server support for legacy TLS 1.0 and 1.1 protocols and verifies intermediate certificate chain completeness. |
| L-A | Domain Email Authentication (SPF & DMARC) | Informational DNS query verifying SPF and DMARC records for the sending domain to prevent email spoofing and spam folder placement. |
| L-A | REST API Security Audit | Enumerates all registered WordPress REST API endpoints, inspects permission callbacks, maps source plugins/themes, and identifies unauthenticated exposure risks. |
| L-A | Environment Tagging & Admin Bar Badge | Tags the environment (Production, Staging, or Development) and displays a persistent color-coded safety badge in the WordPress top admin bar to prevent accidental changes on production. |
| L-A | Developer Diagnostic Snapshot | Generates a sanitized one-click diagnostic snapshot of PHP, server, database, theme, active plugins, and non-sensitive wp-config flags formatted for developer debugging and support tickets. |
| L-A | WP-Cron Scheduled Events Audit | Lists all scheduled WP-Cron background jobs, detects overdue stalled tasks indicating cron failure, and identifies duplicate conflicting hook registrations. |
| L-A | Database Overhead & Orphaned Data Scanner | Detects orphaned postmeta, orphaned usermeta, expired transients, and excess post revisions with storage impact metrics and protected Level-B cleanup. |
| L-A | Migration URL & Serialization Risk Check | Scans the database for hardcoded absolute URLs embedded inside PHP serialized strings that break during domain migrations, providing safe WP-CLI guidance. |
| L-A | Update Changelog Intelligence Digest | Aggregates changelogs and release notes for available plugin/theme updates and delivers a weekly intelligence digest via alerts and dashboard. |
| L-A | External Fingerprint & Information Disclosure Audit | Conducts safe, non-destructive loopback HTTP probes against the site origin to detect exposed sensitive files, version disclosures, backup artifacts, and debug logs. |
Hardening (14 Tasks)
Server security headers, .htaccess protection, wp-config restrictions, and login security.
| Level | Task | Description |
|---|---|---|
| L-A | Disable XML-RPC (Runtime Filter) | Disables XML-RPC pingbacks and brute-force vectors via WordPress core filters and removes discovery link headers. |
| L-A | Restrict REST API User Enumeration | Prevents unauthenticated visitors and bots from enumerating usernames via the /wp/v2/users REST route. |
| L-A | Hide PHP Version (X-Powered-By) | Strips the X-Powered-By server response header. Prioritizes Header unset for modern PHP-FPM servers. |
| L-A | Clickjacking Protection (X-Frame-Options) | Prevents the site from being loaded inside unauthorized iframes to protect against clickjacking attacks. |
| L-A | MIME Sniffing (X-Content-Type-Options) | Prevents browsers from MIME-sniffing a response away from the declared content-type. |
| L-A | HTTP Strict Transport Security (HSTS) | Enforces HTTPS communication with browsers, protecting against man-in-the-middle SSL-strip attacks. |
| L-A | Disable Directory Browsing (Indexes) | Prevents visitors from viewing directory file listings in folders without an index file (e.g., /wp-content/uploads/). |
| L-A | Protect Sensitive System Files | Blocks web access to .env, .git, .bak, readme.html, and wp-config.php directly at the web server layer. |
| L-A | Block xmlrpc.php at Server Level | Drops requests to xmlrpc.php before WordPress PHP boots, preventing DDoS amplification attacks. |
| L-A | Disable Theme & Plugin Editor (wp-config.php) | Adds DISALLOW_FILE_EDIT to wp-config.php so compromised admin accounts cannot inject PHP via the dashboard editor. |
| L-A | Rotate WordPress Security Salts & Keys | Generates 8 fresh 64-char crypto salts in wp-config.php, immediately invalidating all active browser cookies and sessions. |
| L-B | Rename wp-admin Login URL | Hides wp-login.php behind a custom slug. Bridges to WPS Hide Login if present. Recovery is exclusively via WPSG_DISABLE_LOGIN_RENAME in wp-config.php. |
| L-A | Disable Front-End Debug Output (WP_DEBUG_DISPLAY) | Prevents database errors and PHP warnings from displaying on the front-end to site visitors by setting WP_DEBUG_DISPLAY to false in wp-config.php. |
| L-A | Security Disclosure Policy (security.txt) | Verifies and generates RFC 9116 responsible disclosure contact information at /.well-known/security.txt inside the document root. |
SEO SOP (3 Tasks)
Search console indexing integrity, robots.txt audit, and URL removal tracking.
| Level | Task | Description |
|---|---|---|
| L-C | Audit robots.txt Directives | Ensures search engines are not accidentally disallowed from crawling the site and that sensitive admin endpoints are disallowed. |
| L-B | Google Search Console & Bing Review | Audit indexing coverage, security actions, and sitemaps directly in Google Search Console and Bing Webmaster Tools. |
| L-C | 6-Month GSC URL Removal Review | Google Search Console temporary URL removals expire after 6 months. Track submitted removals and schedule rechecks. |
Regular Checks (7 Tasks)
Recurring 15-day credential rotations, vault tracking, and staging site protection.
| Level | Task | Description |
|---|---|---|
| L-C | Rotate cPanel / Hosting Credentials (15d) | Rotate cPanel, FTP, and hosting passwords every 15 days in adherence to the agency security policy. Update vault. |
| L-C | Rotate WordPress Admin Password (15d) | Rotate main administrator credentials every 15 days, notify client if necessary, and store in secure team vault. |
| L-C | Verify Staging Site Auth Protection | Ensure staging and development environments are shielded by HTTP Basic Auth (Directory Privacy) to prevent indexing and bot probing. |
| L-C | Wordfence Email Alert Routing | Verify security alert notifications from Wordfence route to designated agency monitoring inbox. |
| L-C | Quarterly Backup Restore Test (90d) | Untested backups are worthless. Conduct a quarterly rehearsal restoring a database and file backup to a staging environment. |
| L-C | Domain, SSL & Hosting Expiry Audit (90d) | Quarterly review of domain registration, auto-renewal status, SSL certificate validity, and hosting plan limits. |
| L-C | Incident Response Emergency Contact Sheet | Record emergency contact details and escalation protocols in the event of a security incident. Surfaced on client reports. |
Advanced Protection (13 Tasks)
Login throttling, user enumeration defense, session security, and runtime hardening.
| Level | Task | Description |
|---|---|---|
| L-A | Block User & Author Enumeration | Restricts unauthenticated access to /wp/v2/users and intercepts ?author= numeric queries to prevent attacker username discovery. |
| L-A | Login Throttling & Honeypot Protection | Enforces atomic DB-level progressive lockouts (1m, 15m, 60m), silent honeypots, and generic error masking. |
| L-B | Active Session Management | Review concurrent logged-in sessions across devices, terminate stale logins, and enforce automatic session invalidation on password updates. |
| L-A | Hide WordPress Version Meta Tag | Removes the WordPress generator tag from HTML headers and RSS feeds to reduce version fingerprinting. |
| L-A | Remove ?ver= from Enqueued Scripts & Styles | Strips version query strings from script and stylesheet URLs (Opt-in: may impact browser caching on file updates). |
| L-A | Block PHP Execution in /wp-content/uploads/ | Prevents direct execution of PHP scripts in the uploads folder, shutting down web shells uploaded via plugin vulnerabilities. |
| L-A | WordPress Core Files Checksum Scan | Compares local WordPress core files against official WordPress.org release checksums (strictly excluding wp-content). |
| L-A | Scan Uploads for Executable Scripts | Audits /wp-content/uploads/ for suspicious .php, .phtml, or .phar scripts. |
| L-A | Lightweight Query String Firewall | Hardcoded rule set blocking SQL injection, XSS, and traversal signatures in URL query strings (Opt-in; does not replace a network WAF). |
| L-A | Noise Reduction: Block Known Vulnerability Scanners | Blocks requests matching known scanner user agents (sqlmap, nikto, wpscan). Accurately labeled: reduces automated scan log noise. |
| L-A | Content-Security-Policy (Report-Only Mode) | Deploys CSP in safe Report-Only mode to log potential violations without breaking page builders or analytics. |
| L-A | Admin Notice Focus Mode & Dashboard Declutter | Buffers and sanitizes promotional plugin notices while never suppressing WordPress core updates or security warnings. |
| L-B | Audit & Govern Application Passwords | Audit all active application passwords across users, surface unused credentials, and revoke with re-authentication. |
SOP Report (1 Tasks)
Client-ready SOP coverage summary report and export.
| Level | Task | Description |
|---|---|---|
| L-D | Client SOP Coverage Report | Generate a print-ready client audit report summarizing completed hardening, active protections, and outstanding items. |