WordPress powers over 43% of the web — which makes it the biggest target for hackers. Automated bots scan millions of WordPress sites daily looking for outdated plugins, weak passwords, and misconfigured servers. The good news: most attacks are opportunistic, and a few solid hardening steps put you ahead of 95% of sites.

This guide is a complete WordPress security checklist for 2026. It covers every layer — from hosting to code to backups — with step-by-step instructions, code snippets you can copy-paste, a security plugin comparison, and a recovery plan if you get hacked.

Why WordPress gets hacked

WordPress core itself is rarely the problem. The vulnerabilities come from three places:

Source: Wordfence annual threat reports, Sucuri hacked website reports (2024–2026).

Defense in depth: the security layers

Security is not one thing — it is layers. Each layer stops a different kind of attack. If one layer fails, the next one catches it.

Each layer stops a different kind of attack. If one fails, the next one catches it.

Step 1: Secure your hosting (Layer 1)

Your host is the foundation. A bad host undermines everything else.

• Choose a quality host — look for server-level isolation, WAF, malware scanning, and daily backups. Avoid oversold shared hosting. (See our WordPress hosting guide.)
• Enable a WAF — Cloudflare (free tier) or your host’s built-in WAF blocks SQL injection, XSS, and brute force at the edge.
• Use HTTPS — install a free Let’s Encrypt SSL certificate. Force HTTPS in wp-config.php:

  define('FORCE_SSL_ADMIN', true);

• Enable daily backups — automated, off-site, tested. A backup you haven’t tested is not a backup.
• Keep PHP updated — PHP 8.2+ minimum. Older versions have known vulnerabilities.

Step 2: Harden WordPress core (Layer 2)

Update everything

Enable auto-updates for minor releases (security patches). For major releases, update manually after testing.

// wp-config.php — enable auto-updates for minor releases
define('WP_AUTO_UPDATE_CORE', 'minor');

Change the default admin username

Never use “admin” as your username. Create a new admin user with a unique name, then delete the “admin” account. Brute-force bots try “admin” first.

File permissions

Set correct permissions. Wrong permissions let attackers write to your files.

Set permissions via SSH: find /path/to/wordpress -type d -exec chmod 755 {} \; and find /path/to/wordpress -type f -exec chmod 644 {} \;. Then chmod 600 wp-config.php.

wp-config.php hardening

Add these constants to wp-config.php:

// Disable file editing from the dashboard
define('DISALLOW_FILE_EDIT', true);

// Disable plugin/theme installation from dashboard
define('DISALLOW_FILE_MODS', true);

// Force SSL for admin
define('FORCE_SSL_ADMIN', true);

// Limit post revisions (reduces DB bloat)
define('WP_POST_REVISIONS', 5);

// Set memory limit
define('WP_MEMORY_LIMIT', '256M');

// Change the database table prefix (do this during install, not after)
// $table_prefix = 'wp_';  // Change to something unique like 'x7k9_'

Disable XML-RPC

XML-RPC is a legacy API that attackers use for brute-force amplification. Disable it unless you specifically need it (e.g., for the WordPress mobile app or Jetpack).

// functions.php — disable XML-RPC
add_filter('xmlrpc_enabled', '__return_false');

Or block it in .htaccess:

# .htaccess — block XML-RPC
<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

Step 3: Secure authentication (Layer 3)

Strong passwords

Use a password manager (1Password, Bitwarden). Minimum 16 characters, mixed case, numbers, symbols. Never reuse passwords across sites.

Two-factor authentication (2FA)

Enable 2FA for all admin accounts. Use an authenticator app (Google Authenticator, Authy, 1Password) — not SMS (SIM swapping risk). Plugins: WP 2FA, Two Factor, or Solid Security Pro.

Limit login attempts

Block brute-force attacks by limiting failed login attempts. Plugins: Limit Login Attempts Reloaded, Solid Security, or Wordfence. Set: 3–5 attempts, then lockout for 15–30 minutes.

Hide the login URL

Move /wp-login.php to a custom URL (e.g., /my-secret-login/). This stops 99% of automated bot attacks. Plugins: WPS Hide Login, Solid Security.

Disable user enumeration

Attackers probe /?author=1 to discover usernames. Block it:

// functions.php — block user enumeration
add_action('template_redirect', function() {
    if (is_author() && !is_admin()) {
        wp_redirect(home_url());
        exit;
    }
});

Step 4: Audit plugins and themes (Layer 4)

• Delete unused plugins and themes. Deactivated plugins still have code on your server. If a vulnerability is found, attackers can exploit it even if the plugin is inactive.
• Update everything. Enable auto-updates for plugins and themes. Check weekly.
• Verify sources. Only install from wordpress.org or reputable developers. Never use “nulled” (pirated) plugins — they contain malware.
• Remove default themes. Delete Twenty Twenty-Three, Twenty Twenty-Four, etc. if you’re not using them. They’re attack surface.
• Check plugin reputation. Look at last update date, active installations, and support forum. Abandoned plugins are security risks.

Step 5: Database and file security (Layer 5)

Change the table prefix

The default wp_ prefix is targeted by automated SQL injection scripts. Change it during installation (e.g., x7k9_). Changing after install requires database migration — use a plugin like Brozzme DB Prefix.

Protect wp-config.php

Move wp-config.php one directory above your web root if your host allows it. WordPress looks for it there automatically. If you can’t, protect it with .htaccess:

# .htaccess — protect wp-config.php
<Files wp-config.php>
  Order Allow,Deny
  Deny from all
</Files>

Disable directory browsing

# .htaccess — disable directory listing
Options -Indexes

Protect sensitive files

# .htaccess — block access to sensitive files
<FilesMatch "^(wp-config\.php|\.htaccess|\.htpasswd|readme\.html|license\.txt)">
  Order Allow,Deny
  Deny from all
</FilesMatch>

Step 6: SSL and HTTPS

• Install a free Let’s Encrypt SSL certificate (most hosts provide this).
• Force HTTPS site-wide. In wp-config.php: define('FORCE_SSL_ADMIN', true);
• Update WordPress URLs: Settings → General → change both to https://.
• Add an HTTP → HTTPS redirect in .htaccess:

  # .htaccess — redirect HTTP to HTTPS
  RewriteEngine On
  RewriteCond %{HTTPS} off
  RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

• Enable HSTS (HTTP Strict Transport Security) in .htaccess or via your host’s settings.

Step 7: Backups

A backup is your last line of defense. If everything else fails, a clean backup lets you restore in minutes.

• Automated daily backups — use a plugin (UpdraftPlus, BackWPup, BlogVault) or your host’s backup feature.
• Off-site storage — store backups in cloud storage (Google Drive, Dropbox, S3), not on the same server.
• Test restores — a backup you haven’t tested is not a backup. Restore to a staging site monthly.
• Keep 30 days — retain at least 30 days of backups so you can go back before an infection started.
• Database + files — back up both. Files alone won’t restore your content; database alone won’t restore your media.

Step 8: Monitoring and WAF

• Web Application Firewall (WAF): Cloudflare (free tier) or Sucuri. Blocks malicious traffic before it reaches your site.
• Malware scanning: Wordfence, Sucuri, or Solid Security scan files for known malware signatures.
• File integrity monitoring: detect unauthorized file changes. Wordfence and Solid Security do this.
• Uptime monitoring: UptimeRobot or Better Stack. Get alerted if your site goes down (often the first sign of a hack).
• Login monitoring: track failed login attempts and lockouts. Most security plugins log this.

Step 9: Security plugins compared

My recommendation: Start with Wordfence Free for all-in-one protection. If you need a cloud WAF or professional malware removal, upgrade to Sucuri. For simplicity, Solid Security is the easiest to configure.

Post-hack recovery plan

If your site gets hacked, don’t panic. Follow this sequence:

1. Take the site offline. Put it in maintenance mode or disable it. This stops the spread and protects visitors.
2. Change all passwords. WordPress admin, database, FTP/SSH, hosting panel, email. Assume everything is compromised.
3. Restore from a clean backup. Use a backup from before the hack. If you don’t have one, proceed to step 4.
4. Scan and clean. Use Wordfence or MalCare to scan. Remove infected files. Check wp-config.php, .htaccess, and theme/plugin files for injected code.
5. Update everything. WordPress core, plugins, themes. Remove anything you don’t recognize.
6. Check user accounts. Delete unknown admin accounts. Reset all user passwords.
7. Check for backdoors. Search for eval(, base64_decode(, gzinflate(, exec( in all PHP files. These are common backdoor signatures.
8. Reinstall core. Delete wp-admin/ and wp-includes/, re-upload fresh copies from wordpress.org.
9. Request a malware review. If Google blacklisted your site, request a review in Google Search Console after cleaning.
10. Harden. Apply all steps in this guide. Install a security plugin. Enable 2FA. Set up monitoring.

Frequently asked questions

Is WordPress secure?
Yes. WordPress core is secure and regularly audited. Vulnerabilities come from outdated plugins, weak passwords, and bad hosting — not from WordPress itself.

Do I need a security plugin?
Yes. A security plugin provides WAF, malware scanning, login protection, and file monitoring. Wordfence Free is a good starting point.

How often should I update WordPress?
Enable auto-updates for minor releases (security patches). Update major releases, plugins, and themes weekly. Check for updates at least once a week.

What is the most important security step?
Keep everything updated. ~50% of WordPress hacks exploit known vulnerabilities in outdated plugins. If you do nothing else, update your plugins.

Can a security plugin slow down my site?
Some can (Wordfence’s firewall adds a small overhead). Use a cloud WAF (Cloudflare, Sucuri) instead of a plugin-based WAF to minimize performance impact. See our speed optimization guide.

What should I do if my site gets hacked?
Follow the post-hack recovery plan above. If you’re not technical, hire a professional (Sucuri, Wordfence, or a WordPress security specialist). Don’t try to clean it yourself if you’re unsure.

Conclusion

WordPress security is not about being unhackable — it’s about being a harder target than the next site. Bots scan millions of sites looking for low-hanging fruit. If you keep everything updated, use strong passwords and 2FA, set correct file permissions, install a security plugin, and maintain backups, you’re ahead of 95% of WordPress sites.

Start with the checklist: update core/plugins/themes, set file permissions, enable 2FA, install Wordfence Free, and set up daily backups. That’s 30 minutes of work that prevents 95% of attacks.

If you need hosting with built-in security (WAF, isolation, malware scanning, daily backups), Kiravo is a solid European option. Plans start at €9/month with a 30-day money-back guarantee:

See Kiravo hosting plans →

Security is not a one-time task. Set up monitoring, automate updates, and revisit quarterly. Your site — and your visitors — will thank you.