10 WordPress checks to complete before October's end

Every October returns the European Cybersecurity Month (ECSM), the European Union's annual cybersecurity awareness campaign. According to the official ENISA page, the European Cybersecurity Month (ECSM) is the European Union's annual campaign dedicated to promoting cybersecurity among citizens and organisations, an initiative promoted by EU Member States and European public and private organisations, with the support of ENISA and the European Commission, running from 1–31 October 2026.

For anyone managing even just a dozen WordPress installations, it's the right opportunity to do proper maintenance, not merely read yet another security notice. Here are ten checks, with the command or path for each one.

1. PHP version in use

php -v from the command line, or Dashboard → Tools → Site Health in WordPress. According to official core documentation, the minimum recommended PHP version remains 8.3, whilst the minimum supported version is 7.4 from WordPress 7.0 onwards.

2. WordPress core version

wp core version (via WP-CLI) or Dashboard → Updates. Anything below 6.4 lacks full PHP 8.3 support.

3. Plugins with pending updates

wp plugin list --update=available lists plugins with updates available without opening the admin panel.

4. Unused or unpatched themes

wp theme list --status=inactive displays installed but inactive themes: if no longer needed, remove them with wp theme delete <name>.

5. TLS certificate expiration

openssl s_client -connect domain.tld:443 -servername domain.tld </dev/null 2>/dev/null | openssl x509 -noout -dates returns notBefore and notAfter.

6. Last working backup—tested

A backup's mere existence is not enough: it must be restored on a staging environment. With WP-CLI, a minimal check is wp db check after restoration to verify table integrity.

7. Inactive administrator accounts

wp user list --role=administrator --fields=ID,user_login,user_email lists admins. Cross-reference against who is still actively working on the project.

8. PHP memory limits

php -i | grep memory_limit or, in WordPress, the WP_MEMORY_LIMIT constant in wp-config.php. Any value below 256 MB should almost always be raised to prevent "allowed memory size exhausted" errors from heavy plugins.

9. File and directory permissions

From the site root: find . -type d -exec chmod 755 {} \; for directories and find . -type f -exec chmod 644 {} \; for files, checking first with ls -la that no directories are writable by www-data except wp-content/uploads.

10. Security keys in wp-config.php

The lines AUTH_KEY, SECRET_KEY and similar in wp-config.php should be regenerated periodically using the official WordPress.org generator, especially after suspected unauthorised access.

Ten items, ten commands. Complete them once per site before October's end.