WordPress Security Best Practices: 2026 Checklist

WordPress security is a process, not a plugin. A secure site combines trustworthy hosting, prompt updates, strong authentication, tested backups, sensible access controls and monitoring. No single setting makes a website impossible to compromise, but the controls below reduce both the likelihood and impact of an incident.

Start here: Update WordPress, themes and plugins; remove software you do not use; enable two-factor authentication for administrators; confirm that backups are stored off-site; and test that you can restore them.

WordPress security checklist for 2026

• Use supported software: Run the current WordPress release and a supported PHP version offered by your host.
• Update promptly: Apply core, plugin and theme security updates without unnecessary delay.
• Reduce the attack surface: Delete unused themes and plugins, especially abandoned or unlicensed copies.
• Protect accounts: Use unique passwords, two-factor authentication and individual user accounts.
• Limit privileges: Give each person only the role and access required for their work.
• Back up independently: Keep an off-site copy and test restores on a safe environment.
• Secure transport: Enforce HTTPS and use SFTP or SSH instead of unencrypted FTP.
• Monitor the site: Watch for new administrator accounts, unexpected file changes, failed logins and downtime.
• Prepare for incidents: Document who will isolate, restore and validate the site after a compromise.

WordPress’s official Hardening WordPress guide makes an important distinction: the host protects the server environment, while the site owner remains responsible for the WordPress application, its accounts and installed software.

1. Choose hosting with useful security controls

A reputable host should maintain the server stack, isolate customer accounts, provide HTTPS support and explain its backup and recovery process. Managed WordPress hosting may also include a web application firewall, malware response, staging and automatic platform updates.

Ask prospective hosts practical questions: How often are backups created? Where are they stored? Can customers restore them without support? How are compromised sites handled? Which PHP versions are available? Are staging environments isolated from production?

For a comparison of budget and premium options, use the Best Web Hosting for Small Businesses guide. Business-critical WordPress sites can also review the Kinsta Review 2026.

2. Keep WordPress, themes and plugins updated

Outdated software is one of the most avoidable sources of risk. WordPress recommends running the latest release and keeping installed themes and plugins updated. Minor core and security releases are normally applied automatically when the installation supports background updates.

• Back up before major changes. A security update should not be delayed indefinitely, but a recoverable copy gives you a safe route back.
• Test high-risk changes. Use staging for major core releases, PHP changes and updates to plugins that control checkout, membership or forms.
• Enable appropriate automatic updates. They can be useful for trusted, well-maintained plugins, but critical sites still need monitoring and post-update checks.
• Remove unused software. Deactivating a plugin is not the same as deleting its files.
• Never install nulled themes or plugins. They may be modified, unsupported and unsafe.

Follow the official WordPress update instructions when an installation requires manual intervention. After updating, test the home page, login, forms, search, checkout and any custom integrations.

3. Strengthen logins and user access

A strong password is essential, but it should not be the only protection on an administrator account. Use a password manager to generate a unique password and enable two-factor authentication or passkeys through a trusted authentication solution.

• Use individual accounts: Shared administrator credentials make accountability and offboarding difficult.
• Apply least privilege: Authors do not need plugin access, and most content editors do not need administrator rights.
• Remove dormant accounts: Disable or delete access for former staff, agencies and temporary contractors.
• Protect recovery channels: Secure the email accounts used for password resets with multifactor authentication.
• Rate-limit login attempts: Use host, CDN, firewall or application controls to slow automated guessing.

WordPress’s current brute-force defence guide covers strong passwords, 2FA, passkeys, application passwords, rate limiting and firewall options. Changing the login URL can reduce bot noise, but it is not a substitute for these controls.

4. Use HTTPS, SFTP and secure administrative connections

HTTPS protects login credentials and visitor data while they travel between the browser and server. Redirect all HTTP traffic to HTTPS, confirm that WordPress Address and Site Address use HTTPS, and fix mixed-content warnings.

Use SFTP or SSH for server access. Standard FTP sends credentials and files without encryption. Protect SSH keys with passphrases, remove keys that are no longer required and avoid sending credentials through email or chat.

HTTP Strict Transport Security can strengthen HTTPS enforcement, but configure it carefully. A long or preload-enabled HSTS policy can make a misconfigured site inaccessible until the policy expires.

5. Build backups you can actually restore

A backup is useful only if it is complete, recent, accessible during an emergency and successfully restorable. Do not rely solely on a copy stored inside the same hosting account as the website.

• Back up the database: This includes content, users, settings, orders and other structured data.
• Back up wp-content: Preserve uploads, themes, plugins and must-use plugins.
• Preserve configuration: Keep a secure copy of important configuration and custom server rules.
• Store a copy off-site: Use storage that does not depend on the production hosting account.
• Match frequency to change: A brochure site may need daily backups; a busy store may need much more frequent database protection.
• Test restores: Restore to staging periodically and verify media, links, forms, accounts and transactions.

Define how much data the business can afford to lose and how long the site can be unavailable. These recovery targets determine backup frequency and whether a low-cost hosting plan is adequate.

6. Harden WordPress without relying on security theatre

Hardening should reduce useful attacker capabilities while preserving normal site operation. Some popular tricks provide little protection when used alone, and blanket server rules can break REST API, XML-RPC, Ajax, ecommerce or integration features.

• Disable dashboard file editing: Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php so a compromised administrator session cannot use the built-in theme or plugin editor.
• Protect wp-config.php: Restrict file access and permissions according to your hosting environment. Moving it one directory above WordPress is supported in some configurations but should not be treated as mandatory.
• Use appropriate file permissions: Never solve permission errors by broadly applying 777. Ask the host for values suited to its ownership model.
• Disable directory listing: Prevent the server from exposing a browsable file index where it is not required.
• Keep the REST API available unless you understand the impact: WordPress and many plugins depend on it. Restrict sensitive access rather than disabling it indiscriminately.
• Review XML-RPC requirements: If an integration needs it, protect it with rate limiting or firewall controls. If nothing uses it, disabling it may reduce attack traffic.

Changing the database table prefix or hiding the WordPress version may reduce automated noise, but neither fixes vulnerable code, stolen credentials or weak access controls. Prioritise updates, authentication, backups and monitoring.

7. Add firewall, scanning and monitoring layers

A web application firewall can block common malicious requests before they reach WordPress. Edge firewalls process traffic before it reaches the hosting server, while application-level security plugins inspect requests inside the WordPress environment. The right choice depends on the host, traffic and available server resources.

• Uptime monitoring: Alert someone when the site becomes unavailable.
• File-change monitoring: Investigate unexpected changes to core, theme and plugin files.
• Account monitoring: Alert on new administrators, password changes and repeated failed logins.
• Vulnerability notifications: Track security advisories for installed components.
• Activity logs: Record important administrative actions without collecting unnecessary sensitive data.
• Malware scanning: Use it as a detection layer, not as permission to ignore updates and access controls.

Configure alerts so they reach a monitored mailbox or incident channel. A warning that nobody reads does not improve security.

8. Secure forms, ecommerce and customer information

Business sites frequently expose forms, customer accounts, payment integrations and email automation. Protect these workflows as carefully as the WordPress dashboard.

• Collect less data: Do not retain sensitive information without a legitimate business need.
• Use reputable payment gateways: Prefer hosted or tokenised payment flows that keep raw card details away from the WordPress server.
• Verify webhooks: Validate signatures or secrets provided by payment and automation services.
• Restrict exports: Limit who can download orders, customer lists and form entries.
• Protect transactional email: Secure domain DNS, mail service accounts and API credentials.
• Maintain a retention policy: Remove customer and form data when it is no longer required.

Compliance duties depend on the organisation, data, customers and jurisdictions involved. Security guidance is not legal advice; obtain qualified advice when handling regulated or sensitive data.

9. Prepare an incident response checklist

If you suspect a compromise, act deliberately. Deleting a suspicious file without preserving evidence or identifying the entry point can leave the site vulnerable to reinfection.

1. Isolate: Use maintenance controls, firewall rules or hosting support to limit damage.
2. Preserve evidence: Record times, alerts, user accounts, logs and changed files before cleanup where practical.
3. Contact the host: Ask it to preserve logs and help identify server-level activity.
4. Rotate credentials: Replace WordPress, hosting, SFTP, SSH, database, email and API credentials as appropriate.
5. Remove the cause: Patch vulnerable software, remove unknown accounts and replace compromised files from trusted sources.
6. Restore carefully: Use a known-good backup only after identifying how the compromise occurred.
7. Validate: Test the site, scan again, review logs and monitor for recurrence.
8. Communicate: Follow applicable contractual, insurance, privacy and breach-notification requirements.

A practical monthly security routine

• Weekly: Review available updates, backup status, uptime alerts and administrator accounts.
• Monthly: Remove unused software and accounts, review security logs and verify that off-site backups are current.
• Quarterly: Test a restore, audit user roles, review integrations and confirm incident contacts.
• Annually: Reassess the host, recovery targets, security tools, data retention and third-party access.

Frequently asked questions

Do I need a WordPress security plugin?

Not every site needs the same plugin. Managed hosting and an edge firewall may already provide several protections. A security plugin can add 2FA, alerts, file monitoring or application-level filtering, but avoid enabling overlapping features without understanding the performance and configuration impact.

Should WordPress automatic updates be enabled?

Automatic updates are useful for many trusted components, especially on sites that are monitored and backed up. Critical sites should combine them with staging where appropriate, uptime checks and a post-update test routine. Do not postpone known security fixes simply because the next maintenance window is far away.

How often should WordPress be backed up?

Base the schedule on how often the site changes and how much data the business can afford to lose. Daily may suit a small brochure site, while orders, bookings or memberships may require much more frequent database backups. Always keep an independent off-site copy.

Does changing the WordPress login URL secure the site?

It can reduce automated traffic and log noise, but it does not replace strong passwords, two-factor authentication, rate limiting, updates and least-privilege access.

What should I do first today?

Update WordPress and all installed software, delete anything unused, enable two-factor authentication for administrators, confirm that an off-site backup completed, and schedule a test restore.

Final recommendation

Start with the controls that prevent the most common failures: current software, strong account security, independent backups and secure hosting. Then add hardening, monitoring and a written response plan. Review the checklist regularly because the site, its users and its integrations will change over time.