# How to Secure WordPress (Complete Hardening Guide, 2026)
- Link: https://dev.ejohnny.ro/how-to-secure-wordpress-complete-hardening-guide/
- Published: 2026-10-31T12:09:46+02:00
- Author: eJohnny
WordPress powers over 43% of the web — which makes it the biggest target for hackers.
Automated bots scan millions of WordPress sites daily looking for outdated plugins,
weak passwords, and misconfigured servers. The good news: most attacks are opportunistic,
and a few solid hardening steps put you ahead of 95% of sites.
This guide is a complete WordPress security checklist for 2026. It covers every
layer — from hosting to code to backups — with step-by-step instructions, code snippets
you can copy-paste, a security plugin comparison, and a recovery plan if you get
hacked.
Securing WordPress is about being a harder target than the next site.
## Why WordPress gets hacked
WordPress core itself is rarely the problem. The vulnerabilities come from three
places:
| Attack vector | How common | Fix |
| **Outdated plugins/themes** | ~50% of hacks | Keep everything updated, remove unused ones |
| **Weak passwords / brute force** | ~20% of hacks | Strong passwords, 2FA, login rate limiting |
| **Vulnerable hosting / server** | ~15% of hacks | Quality host, file permissions, WAF |
| **Outdated WordPress core** | ~8% of hacks | Enable auto-updates for minor releases |
| **Insecure file permissions** | ~5% of hacks | Set 755/644/600 correctly |
| **Other (nulled themes, SQL injection, etc.)** | ~2% of hacks | Security plugin, WAF, code review |
_Source: Wordfence annual threat reports, Sucuri hacked website reports (2024–2026)._
## Defense in depth: the security layers
Security is not one thing — it is layers. Each layer stops a different kind of attack.
If one layer fails, the next one catches it.
**Layer 1 — Hosting & Server** — WAF, isolation, SSL, backups, server patches
**Layer 2 — WordPress Core** — Updates, admin username, file permissions, wp-config
hardening
**Layer 3 — Authentication** — Strong passwords, 2FA, login rate limiting, hide
login URL
**Layer 4 — Plugins & Themes** — Audit, update, remove unused, verify sources
**Layer 5 — Database & Files** — Table prefix, file permissions, disable file editing
**Layer 6 — Monitoring & Recovery** — WAF, malware scanning, backups, incident
response
_Each layer stops a different kind of attack. If one fails, the next one catches
it._
## Step 1: Secure your hosting (Layer 1)
Your host is the foundation. A bad host undermines everything else.
* **Choose a quality host** — look for server-level isolation, WAF, malware scanning,
and daily backups. Avoid oversold shared hosting. (See our [WordPress hosting guide](https://dev.ejohnny.ro/how-to-choose-good-wordpress-hosting/).)
* **Enable a WAF** — Cloudflare (free tier) or your host’s built-in WAF blocks
SQL injection, XSS, and brute force at the edge.
* **Use HTTPS** — install a free Let’s Encrypt SSL certificate. Force HTTPS in `
wp-config.php`:
* ```
define('FORCE_SSL_ADMIN', true);
```
* **Enable daily backups** — automated, off-site, tested. A backup you haven’t
tested is not a backup.
* **Keep PHP updated** — PHP 8.2+ minimum. Older versions have known vulnerabilities.
## Step 2: Harden WordPress core (Layer 2)
### Update everything
Enable auto-updates for minor releases (security patches). For major releases, update
manually after testing.
```
// wp-config.php — enable auto-updates for minor releases
define('WP_AUTO_UPDATE_CORE', 'minor');
```
### Change the default admin username
Never use “admin” as your username. Create a new admin user with a unique name,
then delete the “admin” account. Brute-force bots try “admin” first.
### File permissions
Set correct permissions. Wrong permissions let attackers write to your files.
| Path | Permission | Why |
| Folders (wp-content, wp-includes, etc.) | `755` | Owner can write, others can read/execute |
| Files (PHP, CSS, JS, images) | `644` | Owner can write, others can read |
| wp-config.php | `600` or `640` | Only owner can read/write — contains DB credentials |
| .htaccess | `644` | Readable by server, writable by owner |
Set permissions via SSH: `find /path/to/wordpress -type d -exec chmod 755 {} \;`
and `find /path/to/wordpress -type f -exec chmod 644 {} \;`. Then `chmod 600 wp-
config.php`.
### wp-config.php hardening
Add these constants to `wp-config.php`:
```
// Disable file editing from the dashboard
define('DISALLOW_FILE_EDIT', true);
// Disable plugin/theme installation from dashboard
define('DISALLOW_FILE_MODS', true);
// Force SSL for admin
define('FORCE_SSL_ADMIN', true);
// Limit post revisions (reduces DB bloat)
define('WP_POST_REVISIONS', 5);
// Set memory limit
define('WP_MEMORY_LIMIT', '256M');
// Change the database table prefix (do this during install, not after)
// $table_prefix = 'wp_'; // Change to something unique like 'x7k9_'
```
### Disable XML-RPC
XML-RPC is a legacy API that attackers use for brute-force amplification. Disable
it unless you specifically need it (e.g., for the WordPress mobile app or Jetpack).
```
// functions.php — disable XML-RPC
add_filter('xmlrpc_enabled', '__return_false');
```
Or block it in `.htaccess`:
```
# .htaccess — block XML-RPC
Order Deny,Allow
Deny from all
```
## Step 3: Secure authentication (Layer 3)
### Strong passwords
Use a password manager (1Password, Bitwarden). Minimum 16 characters, mixed case,
numbers, symbols. Never reuse passwords across sites.
### Two-factor authentication (2FA)
Enable 2FA for all admin accounts. Use an authenticator app (Google Authenticator,
Authy, 1Password) — not SMS (SIM swapping risk). Plugins: WP 2FA, Two Factor, or
Solid Security Pro.
### Limit login attempts
Block brute-force attacks by limiting failed login attempts. Plugins: Limit Login
Attempts Reloaded, Solid Security, or Wordfence. Set: 3–5 attempts, then lockout
for 15–30 minutes.
### Hide the login URL
Move `/wp-login.php` to a custom URL (e.g., `/my-secret-login/`). This stops 99%
of automated bot attacks. Plugins: WPS Hide Login, Solid Security.
### Disable user enumeration
Attackers probe `/?author=1` to discover usernames. Block it:
```
// functions.php — block user enumeration
add_action('template_redirect', function() {
if (is_author() && !is_admin()) {
wp_redirect(home_url());
exit;
}
});
```
## Step 4: Audit plugins and themes (Layer 4)
* **Delete unused plugins and themes.** Deactivated plugins still have code on
your server. If a vulnerability is found, attackers can exploit it even if the
plugin is inactive.
* **Update everything.** Enable auto-updates for plugins and themes. Check weekly.
* **Verify sources.** Only install from wordpress.org or reputable developers.
Never use “nulled” (pirated) plugins — they contain malware.
* **Remove default themes.** Delete Twenty Twenty-Three, Twenty Twenty-Four, etc.
if you’re not using them. They’re attack surface.
* **Check plugin reputation.** Look at last update date, active installations,
and support forum. Abandoned plugins are security risks.
## Step 5: Database and file security (Layer 5)
### Change the table prefix
The default `wp_` prefix is targeted by automated SQL injection scripts. Change
it during installation (e.g., `x7k9_`). Changing after install requires database
migration — use a plugin like Brozzme DB Prefix.
### Protect wp-config.php
Move `wp-config.php` one directory above your web root if your host allows it. WordPress
looks for it there automatically. If you can’t, protect it with `.htaccess`:
```
# .htaccess — protect wp-config.php
Order Allow,Deny
Deny from all
```
### Disable directory browsing
```
# .htaccess — disable directory listing
Options -Indexes
```
### Protect sensitive files
```
# .htaccess — block access to sensitive files
Order Allow,Deny
Deny from all
```
## Step 6: SSL and HTTPS
* Install a free Let’s Encrypt SSL certificate (most hosts provide this).
* Force HTTPS site-wide. In `wp-config.php`: `define('FORCE_SSL_ADMIN', true);`
* Update WordPress URLs: Settings → General → change both to `https://`.
* Add an HTTP → HTTPS redirect in `.htaccess`:
* ```
# .htaccess — redirect HTTP to HTTPS
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
```
* Enable HSTS (HTTP Strict Transport Security) in `.htaccess` or via your host’s
settings.
## Step 7: Backups
A backup is your last line of defense. If everything else fails, a clean backup
lets you restore in minutes.
* **Automated daily backups** — use a plugin (UpdraftPlus, BackWPup, BlogVault)
or your host’s backup feature.
* **Off-site storage** — store backups in cloud storage (Google Drive, Dropbox,
S3), not on the same server.
* **Test restores** — a backup you haven’t tested is not a backup. Restore to a
staging site monthly.
* **Keep 30 days** — retain at least 30 days of backups so you can go back before
an infection started.
* **Database + files** — back up both. Files alone won’t restore your content;
database alone won’t restore your media.
## Step 8: Monitoring and WAF
* **Web Application Firewall (WAF):** Cloudflare (free tier) or Sucuri. Blocks
malicious traffic before it reaches your site.
* **Malware scanning:** Wordfence, Sucuri, or Solid Security scan files for known
malware signatures.
* **File integrity monitoring:** detect unauthorized file changes. Wordfence and
Solid Security do this.
* **Uptime monitoring:** UptimeRobot or Better Stack. Get alerted if your site
goes down (often the first sign of a hack).
* **Login monitoring:** track failed login attempts and lockouts. Most security
plugins log this.
## Step 9: Security plugins compared
| Plugin | Free tier | Key features | Best for | Pricing |
| **Wordfence** | Yes | WAF, malware scanner, login security, file monitoring, 2FA | All-in-one security | Free / $119/yr (Premium) |
| **Solid Security (iThemes)** | Yes | Brute force protection, 2FA, file change detection, password enforcement | Beginners, simple setup | Free / $99/yr (Pro) |
| **Sucuri** | Limited | Cloud WAF, malware removal, DDoS protection, CDN | High-traffic sites, enterprise | $199/yr (Basic) / $499/yr (Pro) |
| **MalCare** | Yes | Malware scanning, one-click cleanup, firewall, backups | Site owners who want auto-cleanup | Free / $99/yr (Plus) |
| **All In One WP Security** | Yes | Brute force, file permissions, database security, firewall | Budget-conscious users | Free (premium being developed) |
**My recommendation:** Start with **Wordfence Free** for all-in-one protection.
If you need a cloud WAF or professional malware removal, upgrade to **Sucuri**.
For simplicity, **Solid Security** is the easiest to configure.
## Post-hack recovery plan
If your site gets hacked, don’t panic. Follow this sequence:
1. **Take the site offline.** Put it in maintenance mode or disable it. This stops
the spread and protects visitors.
2. **Change all passwords.** WordPress admin, database, FTP/SSH, hosting panel, email.
Assume everything is compromised.
3. **Restore from a clean backup.** Use a backup from before the hack. If you don’t
have one, proceed to step 4.
4. **Scan and clean.** Use Wordfence or MalCare to scan. Remove infected files. Check`
wp-config.php`, `.htaccess`, and theme/plugin files for injected code.
5. **Update everything.** WordPress core, plugins, themes. Remove anything you don’t
recognize.
6. **Check user accounts.** Delete unknown admin accounts. Reset all user passwords.
7. **Check for backdoors.** Search for `eval(`, `base64_decode(`, `gzinflate(`, `
exec(` in all PHP files. These are common backdoor signatures.
8. **Reinstall core.** Delete `wp-admin/` and `wp-includes/`, re-upload fresh copies
from wordpress.org.
9. **Request a malware review.** If Google blacklisted your site, request a review
in Google Search Console after cleaning.
10. **Harden.** Apply all steps in this guide. Install a security plugin. Enable 2FA.
Set up monitoring.
## Frequently asked questions
**Is WordPress secure?**
Yes. WordPress core is secure and regularly audited. Vulnerabilities
come from outdated plugins, weak passwords, and bad hosting — not from WordPress
itself.
**Do I need a security plugin?**
Yes. A security plugin provides WAF, malware scanning,
login protection, and file monitoring. Wordfence Free is a good starting point.
**How often should I update WordPress?**
Enable auto-updates for minor releases(
security patches). Update major releases, plugins, and themes weekly. Check for
updates at least once a week.
**What is the most important security step?**
Keep everything updated. ~50% of
WordPress hacks exploit known vulnerabilities in outdated plugins. If you do nothing
else, update your plugins.
**Can a security plugin slow down my site?**
Some can (Wordfence’s firewall adds
a small overhead). Use a cloud WAF (Cloudflare, Sucuri) instead of a plugin-based
WAF to minimize performance impact. See our [speed optimization guide](https://dev.ejohnny.ro/how-to-speed-up-slow-wordpress-site/).
**What should I do if my site gets hacked?**
Follow the post-hack recovery plan
above. If you’re not technical, hire a professional (Sucuri, Wordfence, or a WordPress
security specialist). Don’t try to clean it yourself if you’re unsure.
## Conclusion
WordPress security is not about being unhackable — it’s about being a harder target
than the next site. Bots scan millions of sites looking for low-hanging fruit. If
you keep everything updated, use strong passwords and 2FA, set correct file permissions,
install a security plugin, and maintain backups, you’re ahead of 95% of WordPress
sites.
Start with the checklist: update core/plugins/themes, set file permissions, enable
2FA, install Wordfence Free, and set up daily backups. That’s 30 minutes of work
that prevents 95% of attacks.
If you need hosting with built-in security (WAF, isolation, malware scanning, daily
backups), [Kiravo](https://kiravo.net/) is a solid European option. Plans start
at €9/month with a 30-day money-back guarantee:
[See Kiravo hosting plans →](https://my.kiravo.net/?affid=228)
Security is not a one-time task. Set up monitoring, automate updates, and revisit
quarterly. Your site — and your visitors — will thank you.
### Share this:
* [ X ](https://dev.ejohnny.ro/how-to-secure-wordpress-complete-hardening-guide/?share=twitter)
* [ Facebook ](https://dev.ejohnny.ro/how-to-secure-wordpress-complete-hardening-guide/?share=facebook)
* [More](https://dev.ejohnny.ro/how-to-secure-wordpress-complete-hardening-guide/#)
* [ LinkedIn ](https://dev.ejohnny.ro/how-to-secure-wordpress-complete-hardening-guide/?share=linkedin)
* [ Reddit ](https://dev.ejohnny.ro/how-to-secure-wordpress-complete-hardening-guide/?share=reddit)
* [ Tumblr ](https://dev.ejohnny.ro/how-to-secure-wordpress-complete-hardening-guide/?share=tumblr)
* [ Pinterest ](https://dev.ejohnny.ro/how-to-secure-wordpress-complete-hardening-guide/?share=pinterest)
* [ Telegram ](https://dev.ejohnny.ro/how-to-secure-wordpress-complete-hardening-guide/?share=telegram)
* [ WhatsApp ](https://dev.ejohnny.ro/how-to-secure-wordpress-complete-hardening-guide/?share=jetpack-whatsapp)