WordPress Security Hardening Checklist for 2026

WordPress powers a large portion of the internet, making it a frequent target for hackers. The good news is that most WordPress compromises exploit a limited set of predictable weaknesses, which can be prevented with careful measures.

Updating WordPress core, plugins, and themes is crucial. Enable automatic updates for the core system, and promptly update plugins and themes, ideally on a scheduled basis with testing in a staging environment. Remove any unused plugins or themes, as deactivated plugins are not safe. Install plugins only from reputable sources with an active maintenance history, and be wary of abandoned code.

Strong authentication is the next line of defense. Avoid using "admin" as an administrator username, instead opting for a unique name. Use a strong and unique password for every account, and enable two-factor authentication (2FA) for all admin and editor accounts. Limit login attempts and implement rate limiting to counter brute-force attacks. You may also consider changing or protecting the login URL, and adding CAPTCHA challenges.

Authenticating users with the least necessary privileges is also important. Assign each user the lowest role that allows them to perform their tasks. Regularly audit user accounts and remove former employees or unused logins. Review roles after installing any plugins that introduce new capabilities.

The wp-config.php file, which stores your database credentials and secret keys, requires special attention. Set unique authentication keys and salts, disable the built-in file editor to prevent modifications from the dashboard, and move wp-config.php one level above the web root if your hosting setup allows it. Restrict its file permissions and disable debug mode in production to prevent sensitive information leaks.

File and directory permissions should be set to a standard baseline of 755 for directories and 644 for files, with exceptions where necessary. Web server users should own the files but not be able to write where it is not required. Protect sensitive files, disable directory browsing, and remove unnecessary information, such as the WordPress version, from page output.

Consider disabling XML-RPC if it is not needed, as it can be a vector for brute-force and DDoS attacks. Restrict or authenticate the REST API to prevent exposure of data you do not wish to be public. Remove the WordPress version number and other unnecessary details from page output as well.

A Web Application Firewall (WAF) and HTTPS should be deployed in front of the site to protect against malicious traffic. Serve the entire site over HTTPS, redirecting all HTTP traffic. Add security headers, including HSTS, X-Content-Type-Options, X-Frame-Options, and Content-Security-Policy where appropriate. Use a WAF, either at the CDN level or at the WordPress level.

Database and hosting hardening involves using a non-default database table prefix for new installations, creating a dedicated database user with only the privileges WordPress requires, and ensuring your PHP version is up-to-date and supported. Choose hosting that isolates sites and patches the server stack appropriately.

Regular monitoring, backups, and recovery procedures are essential. Run malware and file-integrity scanning to quickly detect unexpected changes. Enable security logging to track login attempts and changes. Take regular, automated backups stored off the server, and test the restoration process to ensure data can be recovered in the event of a breach.

While following a checklist is crucial, WordPress security hardening benefits from expert reviews. A WordPress security audit can review all plugins and themes, test authentication and access, and examine wp-config.php, the database, and the REST API/ XML-RPC surface, producing a prioritized hardening plan. For a more comprehensive approach to website security, consider a website security audit guide.

If your site requires ongoing development and maintenance, along with hardening, a WordPress developer for hire can help keep the website secure in the long run. For more information on related topics like Linux server hardening, website security audits, server security audits, and Cyber Essentials compliance in the UK, refer to the suggested resources.