How to Secure a WordPress Site: 15 Essential Security Steps for 2026

To secure a WordPress site, keep the core, plugins, and themes updated, use strong passwords with two-factor authentication, install SSL, choose a security-conscious host, and add a firewall, backups, and monitoring. The 15 steps below cover the complete checklist for 2026, in the order you should do them.

None of this requires a computer science degree. It requires about an afternoon, a little discipline, and a willingness to finally delete that plugin you installed in 2023 and never activated. You know the one.

Why bother? Because WordPress powers 40.7% of all websites and holds a 58.9% share of the CMS market. When you run the software that runs almost half the internet, you inherit its fan club: researchers, customers, and unfortunately, every bot with a grudge and a Wi-Fi connection.

Why WordPress security matters more in 2026

Let's look at what the actual data says, because the numbers this year are spicy.

Patchstack's State of WordPress Security in 2026 report documented 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42% increase over 2024. Before you panic and convert your website to a printed brochure, look at where those flaws actually live: 91% were found in plugins and 9% in themes, while WordPress core itself had just 6 reported vulnerabilities all year, all of them low priority.

Translation: WordPress is not the problem. Your 34 plugins are the problem.

Speed matters too. For heavily exploited flaws, the median time from public disclosure to the first exploit attempt is just 5 hours, and 45% of them see exploitation within 24 hours. Attackers do not wait for your quarterly maintenance window. They barely wait for lunch.

Two more numbers worth taping to your monitor: 46% of vulnerabilities had no fix available at the time of public disclosure, and in penetration testing, standard hosting security solutions blocked only 26% of attacks. In other words, you cannot outsource all of this to your host and call it a day.

The good news: WordPress.org publishes an official hardening guide, and its philosophy is refreshingly sane. Security "is not about perfectly secure systems," it says. It is risk reduction, not risk elimination. The 15 steps below are that philosophy, made practical.

Phase 1: Update and clean (steps 1 to 3)

Step 1: Keep WordPress core updated

WordPress.org's first commandment is simple: always run the latest version, and download it only from wordpress.org. Older versions stop receiving security patches, which makes them the software equivalent of leaving your keys in the door.

WordPress 7.1 "Mary Lou" shipped on August 19, 2026. If your dashboard still says 6.x-something, that update button is not decorative.

Turn on automatic updates for minor releases. WordPress has supported them since version 3.7, and they quietly install security fixes while you sleep. It is the only employee you will never have to manage.

Step 2: Update plugins and themes, and delete what you don't use

Remember the 91% statistic. Plugins are where the vulnerabilities live, so this step carries most of the weight:

• Update plugins and themes weekly, or enable auto-updates for the trusted ones.
• Deactivate and delete anything you are not using. A deactivated plugin still sits on your server with all its flaws intact.
• Remove old default themes you never use.

Think of plugins like houseplants. Every one you keep needs regular care, and the dead ones attract pests.

Step 3: Install only from trusted sources

WordPress.org advises downloading plugins and themes only from the official repository or reputable vendors, and avoiding anything that allows arbitrary code execution.

That "free" premium theme from a sketchy download site is not free. It usually ships with a bonus feature called malware, and the license fee is your entire website. Nulled software is how a lot of hacks begin, and it is the easiest one to avoid.

Phase 2: Lock down access (steps 4 to 8)

Step 4: Use strong, unique passwords

WordPress.org recommends password generators and warns against real names, dictionary words, and short or numeric-only passwords. "Fluffy2019" protects nothing except your cat's ego.

Use a password manager, generate 20+ random characters, and never reuse a password across sites. Not sure whether your current password is already floating around the internet? Our guide on checking if your password has been leaked takes five minutes and occasionally ruins someone's afternoon in a useful way.

Step 5: Turn on two-factor authentication

WordPress.org recommends two-factor authentication as an additional layer beyond passwords. With 2FA, a stolen password alone gets an attacker exactly nowhere, which is a delightful thing to imagine.

Use an authenticator app rather than SMS where possible, and enforce 2FA for every administrator account. Yes, including yours. Especially yours.

Step 6: Ditch the "admin" username and limit login attempts

Bots hammer WordPress login pages around the clock, guessing username and password combinations. Their first guess is always the same: admin. WordPress.org specifically recommends avoiding default usernames like "admin" and "webmaster" so automated attacks lose their favourite target.

Pair that with a plugin that limits failed login attempts, so a bot gets a handful of tries instead of forty thousand. Watching a brute-force attack lock itself out is one of life's small pleasures.

Step 7: Serve every page over HTTPS

SSL encrypts the traffic between your visitors and your site, and WordPress.org recommends requiring HTTPS for all admin connections. Browsers also shame non-HTTPS sites with a "Not Secure" label, which converts customers at roughly the same rate as a "Beware of Dog" sign.

Most hosts now include free SSL certificates, so there is no excuse left. If your site still shows that warning, our walkthrough on fixing a "Not Secure" website covers the cleanup, including the mixed-content gremlins that appear after switching.

Step 8: Choose a security-conscious host and use SFTP

WordPress.org advises choosing hosts that talk openly about security, run current server software, and offer reliable backup and recovery. Given that standard hosting defences blocked only 26% of attacks in testing, "cheapest plan on the internet" is not a security strategy.

When you transfer files, use SFTP instead of FTP. Same job, except your password is not broadcast in plain text like a radio jingle.

Phase 3: Harden the guts (steps 9 to 12)

Step 9: Set correct file permissions

File permissions decide who can read and write your site's files. WordPress.org's official scheme is 755 for directories and 644 for files, with core directories like /wp-admin/ and /wp-includes/ writable only by your user account.

If any file or folder is set to 777, that is not a permission, that is an open invitation with valet parking. Fix it from your hosting control panel or via SFTP.

Step 10: Disable file editing in the dashboard

By default, WordPress lets administrators edit theme and plugin code right in the dashboard. Handy for you, and even handier for an attacker who compromises an admin account.

WordPress.org recommends switching it off by adding one line to wp-config.php:

define( 'DISALLOW_FILE_EDIT', true );

One line of code, one entire attack route closed. That is the best exchange rate in security.

Step 11: Protect wp-config.php

Your wp-config.php file holds your database credentials and security keys, which makes it the crown jewels of your installation. WordPress.org recommends restricting its permissions to 400 or 440 and, where possible, moving it one directory above your WordPress folder or denying access to it via .htaccess.

Ask your developer or host to handle this one if the words ".htaccess" cause mild dizziness. It is a ten-minute job for someone who does it often.

Step 12: Change the database prefix and trim database privileges

Every default WordPress install uses database tables starting with wp_, which automated SQL injection attacks are built to expect. WordPress.org recommends changing that default prefix, using a separate database per site, and granting the database user only the privileges day-to-day WordPress actually needs: SELECT, INSERT, UPDATE, and DELETE.

This is a set-it-once job, best done at install time or by someone comfortable in the database. The payoff is that an entire class of lazy, automated attacks stops matching your site.

Phase 4: Defend and watch (steps 13 to 15)

Step 13: Add a firewall and a security plugin

A web application firewall (WAF) filters malicious traffic before it reaches WordPress. The official hardening guide points to security plugins and WAF options, including CDN-based firewalls that absorb attacks before they ever touch your server.

This matters double in 2026 because of that 5-hour exploit window. A good firewall with virtual patching can block a new exploit pattern while you are still asleep, which is exactly where you should be at 3 a.m.

Step 14: Back up automatically, store off-site, test restores

WordPress.org recommends regular backups of both your database and your full installation, stored independently from your server, with restore procedures you have actually tested.

The last part is the one everyone skips. An untested backup is a rumour, not a plan. Schedule daily automated backups, keep copies off your server, and do a practice restore once in a while. Future you, standing in the smoking crater of a hacked site, will be very grateful.

Step 15: Monitor logs, file changes, and malware

Finally, watch the place. WordPress.org recommends enabling access and error logs, monitoring files for unexpected changes (especially .php files), and using file integrity tools.

In practice, this means a security plugin with malware scanning and file-change alerts, plus an occasional look at your logs. Remember, 46% of vulnerabilities had no patch at disclosure. Monitoring is how you find out something is wrong before Google does, and Google is not known for breaking bad news gently.

Bringing it all together

Run the 15 steps top to bottom and you have covered updates, access, hardening, and defence: the same territory the official WordPress hardening guide covers, minus the jargon headache. Block an afternoon for the first pass, then it is 20 minutes of upkeep a week.

And if your website is due for a bigger refresh anyway, security is easiest to build in during a rebuild. Our website redesign checklist shows where security fits into that process.

Rather have someone else hold the wrench?

Fair. Between file permissions, database privileges, and whatever a WAF is, some business owners would rather spend that afternoon running their actual business.

At Wide Ripples, secure, fast WordPress sites are the foundation under everything else we build, because a hacked website generates exactly zero leads. Our website maintenance plans cover this whole checklist as a standing job: updates applied and tested, daily off-site backups you can actually restore from, a firewall, malware scanning, and someone watching the logs so you do not have to. Clients rate us 4.8 out of 5, and the sites we build and maintain have carried some serious traffic. One client lifted conversions by 63% and revenue by 159% with 2,780 leads over two years. We like giving clients a number they can hold us to every month, and "days since hacked" staying at infinity is one of our favourites.

Want your WordPress site secured, sped up, and actually generating leads? Book a free consultation with Wide Ripples and we will handle the hardening while you handle the business.

FAQs about WordPress security

Is WordPress a secure platform?

Yes, WordPress core is secure and actively maintained, with only 6 core vulnerabilities reported in 2025. The real risk comes from plugins and themes, which accounted for all the rest of the ecosystem's 11,334 reported flaws. A well-maintained WordPress site is a hard target.

Why do WordPress sites get hacked so often?

WordPress sites usually get hacked through outdated plugins, weak passwords, or nulled themes, not through WordPress itself. Because WordPress runs 40.7% of all websites, attackers automate their attacks at massive scale, and unmaintained sites are the ones that get caught.

What is the best way to secure a WordPress site?

The best way to secure a WordPress site is to keep everything updated, use strong passwords with two-factor authentication, install SSL, and add a firewall with automatic backups. Those five moves stop the vast majority of common attacks before they start.

How do I know if my WordPress site has been hacked?

Common signs of a hacked WordPress site include new admin users you did not create, spam pages or redirects, browser security warnings, a sudden traffic drop, or a warning in Google Search Console. A malware scanner can confirm an infection and identify the affected files.

What should I do first if my WordPress site is hacked?

First, put the site in maintenance mode and change every password: admin, hosting, database, and SFTP. Then restore a clean backup or run a malware cleanup, update everything, and request a review in Google Search Console if Google flagged the site.

Do I really need a security plugin for WordPress?

Yes, most WordPress sites benefit from a security plugin. WordPress core handles the basics, but a security plugin adds login protection, a firewall, malware scanning, and file-change alerts in one place. Official WordPress documentation points to firewalls and monitoring as recommended hardening layers.

Is a free SSL certificate good enough for my website?

Yes, a free SSL certificate provides the same encryption strength as a paid one for a typical business website. What matters is that every page loads over HTTPS with no mixed-content warnings. Paid certificates mainly add things like extended validation, which most small businesses do not need.

How often should I update my WordPress site?

Check for updates at least weekly, and turn on automatic updates for minor WordPress releases and trusted plugins. Nearly half of heavily exploited WordPress vulnerabilities are attacked within 24 hours of disclosure, so a monthly update habit leaves your site exposed for weeks at a time.

Do I need two-factor authentication on WordPress?

Yes, two-factor authentication is one of the highest-value security upgrades for WordPress. It means a stolen or guessed password is no longer enough to get into your dashboard. Official WordPress guidance recommends it as a standard layer on top of strong passwords.

Can I secure my WordPress site for free?

Yes, most essential WordPress security steps are free. Updates, strong passwords, two-factor authentication, free SSL certificates, security plugins with free tiers, and correct file permissions cost nothing but time. Paid tools mainly add convenience, premium firewalls, and professional monitoring.

Does a hacked website affect SEO?

Yes, a hacked website can seriously damage your SEO. Google may flag your site with warnings, drop infected pages from results, or remove the site entirely, and visitors bounce the moment they see a security warning. Recovered rankings can take weeks or months to return.

How much does WordPress security cost?

Basic WordPress security costs nothing beyond your time, since updates, 2FA, SSL, and free security plugins cover the essentials. Premium tools add a modest monthly amount, and a professionally managed care plan costs more but folds in maintenance, monitoring, and fixes. Our own website maintenance plans publish those prices.