To secure a WordPress website, keep core, plugins and themes updated, use strong unique passwords with two-factor login, run daily off-site backups, use HTTPS and a firewall, limit admin accounts, and choose a host that runs a supported PHP version. These basics stop the vast majority of attacks, which are automated bots hunting for outdated plugins and weak logins.
- Most WordPress hacks come through outdated or nulled plugins, not WordPress core.
- Two-factor login makes stolen passwords almost useless.
- Backups do not prevent hacks, but they turn a disaster into an inconvenience.
- Fewer plugins and fewer admins means fewer ways in.
- Security is a monthly habit, not a one-time setup.
Why do hackers target small WordPress sites?
Picture a local accountant who says, “Nobody would bother hacking my little site.” He is right that no person would. Bots would, and they do it thousands of times a day. They scan the internet for any site running a plugin with a known hole, then use it to host spam pages, send phishing emails or redirect visitors.
WordPress powers a huge share of the web, so it is the biggest target. The good news is that the core software is well maintained. The weak spots are almost always things the site owner controls.
What is the WordPress security checklist for 2026?
| Area | What to do | Why it matters |
|---|---|---|
| Updates | Update core, plugins and themes weekly; enable auto-updates for trusted plugins | Closes known vulnerabilities bots scan for |
| Logins | Unique passwords, two-factor authentication, limit login attempts | Stops brute force and credential stuffing |
| Users | Few admins, Editor or Author role for staff, remove old accounts | Limits damage from one stolen account |
| Backups | Daily automatic backups stored off the server | Fast recovery from any problem |
| HTTPS | Valid SSL certificate, force HTTPS sitewide | Protects logins and builds trust |
| Firewall | Plugin firewall or a CDN WAF such as Cloudflare | Blocks malicious traffic before it hits WordPress |
| Hosting | Supported PHP version, account isolation, malware scanning | Secure foundation under everything else |
| Software | No nulled themes or plugins, delete unused ones | Removes hidden backdoors and dead code |
How do you harden WordPress settings step by step?
- Disable the file editor. Add
define('DISALLOW_FILE_EDIT', true);to wp-config.php so a stolen login cannot edit PHP files from the dashboard. - Change the default admin username if it is “admin”, and never show your login name as your public author name.
- Turn on two-factor authentication with a security plugin or a dedicated 2FA plugin.
- Limit login attempts and consider protecting wp-login.php with a CAPTCHA or a firewall rule.
- Set correct file permissions: 755 for folders, 644 for files, and 600 or 640 for wp-config.php where your host allows it.
- Block PHP execution in uploads with a server rule. Images never need to run code.
- Set up activity logging so you can see who changed what.
Malware removal, blacklist cleanup, updates and a hardened setup with backups and a firewall. Free first check of your site.
Which security plugin should you use?
You need one good security plugin, not three. Running several firewalls together slows the site and causes conflicts. Wordfence, Solid Security and similar tools all cover firewall, malware scanning, login protection and alerts. If your host already provides a server firewall and malware scanning, a lighter plugin for 2FA and login limits may be enough. Pair it with a backup plugin such as UpdraftPlus or your host’s backups.
How often should you check WordPress security?
- Weekly: apply updates, glance at the security plugin alerts.
- Monthly: review users, remove unused plugins, test that a backup actually restores.
- Every quarter: check PHP version, SSL expiry, and run a full malware scan.
Already dealing with an infection? Follow the hacked WordPress recovery guide first. Security also affects rankings, so pair this with the WordPress SEO checklist.
Frequently asked questions
Is WordPress secure?
WordPress core is actively maintained and secure. Most hacks come from outdated or pirated plugins, weak passwords and poor hosting, which you can control.
Do I need a security plugin?
Most sites benefit from one security plugin for firewall, scanning and login protection. Use only one to avoid conflicts and slowdowns.
Does changing the login URL make WordPress secure?
It reduces bot noise but is not real security on its own. Strong passwords, two-factor login and updates matter far more.
How often should I back up WordPress?
Daily for most business sites, and before every major update. Store backups off the server.
Can I secure WordPress myself?
Yes, the checklist in this guide covers the basics. For stores, membership sites or sites that were hacked before, a professional audit is worth it.
Sources
Malware removal, blacklist cleanup, updates and a hardened setup with backups and a firewall. Free first check of your site.
More WordPress guides
Guide, 5 min readWordPress Maintenance: What It Includes and What It Costs
Guide, 4 min readHow to Recover a Hacked WordPress Website (2026 Guide)
Guide, 3 min readHow to Price Your WordPress Services for Clients (2026 Guide)
Guide, 4 min readHow to Speed Up Your WordPress Website: Advanced Tips (2026 Guide)Rather have an expert run your WordPress site?
Tanvir H is a Bangladesh-based WordPress and Elementor web designer with 7+ years of experience, 650+ projects and a 4.9 client rating. New websites, redesigns, fixes, speed, security and SEO, handled by one expert who explains everything in plain English and works with clients worldwide.
