WordPress security: a 15-point checklist for 2026
A hacked site can redirect your customers to scams, send spam from your domain and drop out of Google within days. The good news: almost every attack is preventable with basic practices. These are the ones we apply on every project.
Key takeaways
- Most WordPress vulnerabilities are in plugins and themes, not in core.
- The three defenses that protect the most: keep everything updated, use 2FA and keep off-site backups.
- If your forms collect personal data, privacy laws apply too (such as the CCPA in California or the GDPR for EU visitors).
Why attackers target small sites
Attackers don't pick your site by hand: they use bots that scan millions of sites looking for vulnerable versions of popular plugins or weak passwords. If your site has the hole, it gets hit, no matter how small your business is. According to annual reports from companies like Patchstack and Wordfence, over 90% of the vulnerabilities reported in the WordPress ecosystem are in plugins.
Updates and software
1. Keep everything updated
Core, plugins and themes. Enable automatic updates at least for minor releases and trusted plugins. Check the dashboard once a week.
2. Delete what you don't use
A deactivated plugin still has files on the server that can be vulnerable. If you don't use it, delete it. Same with themes: keep only the active one and one default theme as a fallback.
3. Never use "nulled" plugins or themes
Pirated versions of premium plugins almost always include backdoors. Whatever you save on the license, you'll pay many times over cleaning up the site.
4. Run a supported PHP version
Old PHP versions stop receiving security patches. Use PHP 8.3 or newer and test compatibility in staging before switching.
Access and users
5. Unique passwords and two-factor authentication (2FA)
WordPress doesn't ship with 2FA: enable it with a security or authentication plugin, at least for administrators and editors. Use a password manager.
6. Limit login attempts
Block IPs after several failed attempts and add a CAPTCHA or bot protection to the login form.
7. Least privilege
Don't use the "admin" username. Give each person only the role they need: a writer doesn't need to be an administrator. Remove accounts for former employees and vendors.
Server and configuration
8. HTTPS everywhere
An SSL certificate (free with Let's Encrypt on most hosts), an HTTP-to-HTTPS redirect and an HSTS header once everything works.
9. Disable the file editor
If someone steals an admin account, the theme and plugin editor lets them inject code in seconds. Disable it in wp-config.php:
// wp-config.php
define( 'DISALLOW_FILE_EDIT', true );
define( 'FORCE_SSL_ADMIN', true );10. Correct file permissions
Folders at 755, files at 644 and wp-config.php at 640 or 600. Never 777.
11. Disable XML-RPC if you don't use it
It's a frequent target for brute-force attacks. If you don't use the WordPress mobile app or services that need it, block it at the server:
# .htaccess
<Files xmlrpc.php>
Require all denied
</Files>12. HTTP security headers
Add at least X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy and clickjacking protection (X-Frame-Options or CSP frame-ancestors). You can check your site at securityheaders.com.
Backups and monitoring
13. 3-2-1 backups
Three copies, on two different media, one off-site (Google Drive, Dropbox, S3). Backups that only live on the same host disappear with it. Most important: test a restore at least once.
14. Firewall and malware scanning
A web application firewall (WAF) blocks known attacks before they reach WordPress. It can live in a plugin (Wordfence, Solid Security), at your host (see how to choose hosting) or in a service like Cloudflare. Pair it with periodic file scans.
15. Monitor and log
Uptime monitoring (alerts you when the site goes down), a user activity log and Google Search Console alerts, which notify you if Google detects malware or hacked content.
Personal data: if your site collects names, emails or phone numbers, publish a privacy policy, collect only what you need and protect it. Depending on where your visitors live, laws like California's CCPA/CPRA, other state privacy laws or the EU's GDPR may apply.
What if you've already been hacked?
- Don't delete anything yet. Put the site in maintenance mode and back up its current state for analysis.
- Change every password: WordPress, hosting, FTP/SFTP, database and email. Regenerate the security keys in
wp-config.php. - Restore a clean backup from before the attack or, if you don't have one, reinstall core and plugins from official sources and clean the database.
- Find the entry point (vulnerable plugin, leaked password) and close it, or the attack will repeat.
- Request a review in Search Console if Google flagged your site as dangerous.
Frequently asked questions
Is WordPress insecure?
No. WordPress core has a dedicated security team and gets patched quickly. The vast majority of hacks come from outdated plugins and themes, weak passwords and poorly configured hosting.
Do I need a security plugin?
It's recommended for having a firewall, login limiting, 2FA and file scanning in one place. But no plugin makes up for skipping updates or backups.
How often should I back up?
For a business site, weekly backups are usually enough. For online stores or sites with daily content, back up the database daily. Always keep at least one copy off the server.
Conclusion
WordPress security isn't a product you install once; it's a habit. If you can only do three things today, make them these: update everything, enable 2FA for administrators and set up automatic off-site backups. That alone puts you ahead of most of the sites the bots go after.
