WordPress Security in 2026: The Checklist We Use on Every Site

Most hacked WordPress sites aren’t targeted. They’re found by automated scanners looking for a known weakness: a plugin nobody updated, an admin account with a reused password, or a forgotten staging copy. The good news is that the same short list of habits closes almost all of those doors.

This is the checklist we apply to every WordPress site we build or maintain.

1. Keep everything updated, and remove what you don’t use

Year after year, security researchers find that the vast majority of WordPress vulnerabilities are in plugins, not WordPress itself. So the biggest win is plugin hygiene:

• Turn on automatic updates for WordPress minor releases and for well-maintained plugins
• Test major updates on a staging copy first, then apply them within days, not months
• Delete plugins and themes you aren’t using. Deactivated code can still be exploited.
• Replace plugins that haven’t been updated in over a year, or have been closed on WordPress.org
• Run a supported PHP version. Old PHP versions stop receiving security fixes, and many hosts keep sites on them until someone asks.

2. Lock down logins

• Two-factor authentication or passkeys for every account that can publish or change settings
• Unique passwords stored in a password manager, never shared between people
• Least privilege: editors don’t need to be administrators, and freelancers’ accounts should be removed when the work ends
• Limit login attempts to slow down password-guessing bots
• Application passwords for integrations, so a connected tool never uses a real person’s login

3. Harden the configuration

A few settings in wp-config.php and the server remove whole categories of attack:

// Stop plugins and themes being edited from the dashboard
define( 'DISALLOW_FILE_EDIT', true );

// Force HTTPS for the admin area
define( 'FORCE_SSL_ADMIN', true );

• Disable XML-RPC if nothing uses it (the mobile app and some older integrations do)
• Stop PHP files running from the uploads folder
• Add security headers, such as Strict-Transport-Security and X-Content-Type-Options
• Password-protect or block indexing of staging sites, which often run old code

4. Put a firewall in front of the site

A web application firewall blocks known attack patterns before they reach WordPress. It can run at the network edge, such as Cloudflare or your host’s firewall, or as a plugin. Edge firewalls also absorb bot traffic that would otherwise slow the site down.

5. Back up, and test the backup

• Daily automatic backups of files and database, stored off the server
• At least 30 days of history, since infections are often found weeks later
• A test restore every few months. A backup nobody has restored is a guess.

6. Monitor so you hear first

• Uptime monitoring with alerts to a real person
• File-change and malware scanning
• Vulnerability alerts for the plugins you actually run
• Google Search Console, which warns you if Google detects malware or spam on the site

Security plugins worth knowing

You don’t need several. Pick one that fits your hosting and stick with it:

• Wordfence: firewall, malware scanning and login security in one plugin
• Solid Security (formerly iThemes Security): hardening settings, two-factor and brute-force protection
• Patchstack: vulnerability alerts and virtual patches for plugins with known issues
• Sucuri: an edge firewall and malware clean-up service

If the site has already been hacked

1. Take a full backup of the infected site for investigation, then put up a maintenance page
2. Change every password: WordPress users, hosting, database, FTP/SFTP and email
3. Restore from a clean backup, or have the infection cleaned professionally
4. Update everything and remove any plugin that was the likely entry point
5. Request a review in Google Search Console if a warning appeared

Security is mostly maintenance done on time. If nobody currently owns updates, backups and monitoring for your site or your clients’ sites, our monthly care plans cover all of it, including white-label plans for agencies.