# WordPress Security Checklist: What to Turn On in xCloud, in Order > A step-by-step WordPress security checklist for xCloud: two-factor sign-in, BetterShield, firewalls, admin cleanup, backups and what to do if a site is hacked. Most hacked WordPress sites are not broken into through a clever exploit. Someone signs in with a real password that was leaked, guessed or stolen from a team member's computer. A firewall cannot tell that sign-in apart from yours, so the steps that matter most are the ones that protect the login. xCloud has a tool for each step below, and most of them are free. They are **off until you turn them on**, so work through this list once for every WordPress site. Do the steps in order. The first four stop most attacks, and the rest limit the damage if someone still gets in. For a tour of every security tool in the dashboard, see [Server and website security with xCloud](/docs/server-and-website-security-with-xcloud/). ## What each layer can and can't stop | Layer | Stops | Doesn't stop | | --- | --- | --- | | Two-factor sign-in | A stolen or guessed password | Someone who also has the phone or passkey | | BetterShield login limits and bot checks | Password guessing and login scripts | One correct sign-in on the first try | | 7G and 8G firewall | Known attack patterns in web requests | A normal sign-in with a real password | | Vulnerability Scan and Site Security PRO | Attacks on plugins and themes with a known security bug | Logins, or a plugin someone installs after signing in | | Backups | Losing your site for good | The break-in itself | That is why this checklist starts with sign-ins and ends with firewalls and backups. ## Step 1: Turn on two-factor for your xCloud account and your team Your xCloud account can open every site's WP Admin through Magic Login, so protect it first. Turn on two-factor authentication under **Account Settings → Authentication** and keep your recovery codes somewhere safe: see [Two-factor authentication in xCloud](/docs/two-factor-authentication-set-it-up-and-recover-access-if-you-lose-your-device/). Ask every team member to do the same. Then give each person only the access they need: a Site Admin for the sites they work on, a Server Admin only for the servers they manage. See [Team roles and permissions](/docs/team-roles-permissions-in-xcloud/). ## Step 2: Turn on BetterShield on every WordPress site BetterShield is free login protection that xCloud installs and connects for you. Open the site, go to **Security → Overview & Firewall** and turn on the switch on the **WP Fail2Ban & Login Protection** card. xCloud sets it up with every protection on: - **Failed-login limits**: 5 failures within 15 minutes pause sign-in for 15 minutes. - **Bot check** and **proof-of-work check** on the login and comment forms, which stop most login scripts. - **Server firewall bans** for connections that keep failing. Follow [Set up BetterShield login protection](/docs/set-up-bettershield-login-protection-in-xcloud/) for the details and requirements. A site that still runs WP Fail2Ban moves to BetterShield with the same switch. ## Step 3: Require two-factor for every admin and editor This is the step that stops a stolen password. xCloud turns on BetterShield's login limits, but two-factor sign-in is set up inside WordPress: 1. Click **Open BetterShield in WordPress** on the **WP Fail2Ban & Login Protection** card. It signs you in with Magic Login and opens the BetterShield page. 2. Set up two-factor or a passkey for your own account first, and print your recovery codes. 3. Require two-factor for the **Administrator** and **Editor** roles, and for **Shop Manager** on a WooCommerce store. 4. Shorten the grace period. BetterShield gives users 14 days by default to set up two-factor, and until they do, a password alone still works. Ask your team to set it up today, then shorten or end the grace period. If the site runs Site Security PRO, you can use its **Two-factor authentication** control instead. Use one or the other, not both. ## Step 4: Clean up WordPress admin accounts Every admin account is a password that can leak. In WP Admin, open **Users** and filter by **Administrator**: - Delete accounts of people who left and accounts nobody has used in months. Give their content to another user when WordPress asks. - Lower anyone who only writes content to **Editor** or **Author**. - For your own team, sign in with [Magic Login](/docs/magic-login-in-xcloud/) instead of keeping a personal admin password. It signs you in through your xCloud account, which has its own two-factor. See [Customize Magic Login](/docs/how-to-customize-magic-login/) to choose which WordPress user it signs in as. Then set new passwords for the admin accounts you keep, especially if a password was ever shared in chat or email. ## Step 5: Turn on the 7G firewall The 7G firewall blocks common attack requests, such as SQL injection and bad bots, before they reach WordPress. Turn it on under **Security → Overview & Firewall**: see [Use the xCloud 7G firewall](/docs/use-xcloud-7g-firewall-on-nginx/). The [8G firewall](/docs/enable-8g-firewall-in-xcloud/) is stricter and can block real requests, such as a payment callback or a form. Turn it on for a staging copy first, test the site, then turn it on for the live site. If a rule blocks something you need, [whitelist that rule](/docs/whitelist-7g-and-8g-waf-rules-in-xcloud/). ## Step 6: Find and fix vulnerable plugins and themes Run the free [Vulnerability Scan](/docs/vulnerability-checker-in-xcloud/) under **Security → Vulnerability Scan** and update or remove anything it reports. The [Security Center](/docs/find-and-fix-security-issues-with-xcloud-security-center/) shows the same findings for all your sites on one page. For stores and other sites you can't afford to lose, add [Site Security PRO](/docs/set-up-site-security-pro/). It is a paid add-on per site, powered by Patchstack. It blocks attacks on a vulnerable plugin before an update exists, and adds CAPTCHA on the login form, a custom login URL and a log of blocked attacks. See the [Site Security PRO page](/site-security-pro/) for the current price. ## Step 7: Stop code changes from WP Admin Someone who gets into WP Admin often installs a file manager plugin or edits theme code to keep access. Make that harder: - Turn on the file editor lock, so nobody can edit theme and plugin code from WP Admin. It is one of BetterShield's fixes, and the **Disable file editor** control in Site Security PRO's Basic hardening. - On sites where nobody should install plugins from WP Admin, add `define( 'DISALLOW_FILE_MODS', true );` in **WordPress → WP Config**. This also hides plugin, theme and core updates in WP Admin, so decide how you will update the site first, for example with the [Updates Manager](/docs/manage-wordpress-updates-with-updates-manager/). ## Step 8: Keep backups, a file baseline and real visitor IPs These don't stop a break-in. They let you find out what happened and recover. - **Backups**: turn on scheduled site backups and keep a copy off the server, for example in S3 or Google Drive. See [Backups in xCloud](/docs/backups-in-xcloud/). - **Integrity Monitor**: run a scan under **Security → Integrity Monitor** while the site is clean, so later changes to core and plugin files stand out. See [Verify WordPress checksums](/docs/verify-wordpress-checksums/). - **Real visitor IP behind Cloudflare**: without it, your logs and bans show Cloudflare's addresses instead of the attacker's. See [Show the visitor's real IP behind Cloudflare](/docs/show-visitor-real-ip-behind-cloudflare-proxy/). ## Step 9: Keep server access short-lived Sudo users and SSH keys belong to the server, not to a team member. Removing someone from your team does not remove the sudo users or SSH keys they used. - When someone needs server access for one job, tick **Temporary** when you create the sudo user. xCloud removes it from the server 12 hours later. See [Sudo users and site users](/docs/usudo-users-and-site-users-in-xcloud/). - When someone leaves, delete their sudo users and [SSH keys](/docs/how-to-generate-and-add-ssh-keys-in-xcloud/) on every server, as well as their team membership. - To allow SSH only from your own addresses, see [SSH lockdown](/docs/how-to-configure-ssh-lockdown/). ## Step 10: Test the site after each change Security settings can block real visitors. After each step, check the things your site depends on: checkout and payments, contact forms, sign-in for customers and members, and any API or webhook that talks to another service. If something breaks, undo the last change first, then turn it back on with the fix from its doc. ## If you think someone already got in 1. **Take the site offline** with [Disable Site](/docs/disable-site-in-xcloud-hosting/) so the attacker can't use it while you work. 2. **Lock the doors**: set new passwords for every WordPress admin, your xCloud account and the site's database, and remove admin accounts you don't recognise. 3. **Find what changed**: check BetterShield's activity log for sign-ins and new plugins, and run **Integrity Monitor** for changed files. 4. **Restore a clean backup** from before the break-in, or rebuild the site, then work through this checklist before you turn the site back on. 5. **Block the attacker's address** with the blacklist in [IP Management](/docs/whitelist-or-blacklist-any-ip-address-for-website/), or turn on [Under Attack Mode](/docs/how-to-turn-on-cloudflare-under-attack-mode/) while you investigate if the domain is connected through xCloud's Cloudflare integration. ## Frequently asked questions ### Will the 7G or 8G firewall stop someone who has my WordPress password? No. A firewall blocks requests that look like attacks. A sign-in with the right username and password looks like a normal visit, so it passes. Two-factor sign-in is what stops a stolen password. ### Do I need Site Security PRO if I turn on BetterShield? Not for login protection: BetterShield is free and covers failed-login limits, two-factor sign-in, passkeys and bot checks. Site Security PRO adds virtual patching for vulnerable plugins and themes, CAPTCHA and a custom login URL, so it suits stores and other business-critical sites. ### Should I turn on two-factor in both BetterShield and Site Security PRO? No. Pick one. Patchstack advises against turning on the same feature twice, and two prompts at sign-in confuse your users. ### Does whitelisting my IP in IP Management block everyone else from wp-admin? No. A whitelisted address is only kept from being blocked. Everyone else can still reach the site and its login page. Use the blacklist to block an address you know is attacking you. If you run into any issues with these steps, feel free to reach out to our [support team](/docs/access-built-in-support-portal-in-xcloud/).