Secure Your WordPress Website: Essential Tips and Best Practices

WordPress powers roughly 43% of the web, which makes it the most targeted CMS by automated attack bots. Most WordPress hacks aren’t the result of sophisticated zero-day exploits — they come from outdated plugins, weak admin passwords, and misconfigured servers. The good news is that the same things that make WordPress vulnerable are almost entirely within your control.

This guide covers ten concrete steps you can take right now to harden your WordPress installation against the most common attack vectors. Before any of this: if you’re still in the planning stage, the five decisions to make before building a WordPress site covers hosting environment choices that affect your security posture from day one.

Step 1: Keep WordPress core, themes, and plugins updated

Outdated software is the leading cause of WordPress compromises. The WordPress security team discloses and patches vulnerabilities quickly — but that patch only protects you once it’s installed. The typical attack window between a public vulnerability disclosure and mass exploitation is under 48 hours.

What to update, and how:

• WordPress core: Enable automatic minor-version updates in wp-config.php:
  define('WP_AUTO_UPDATE_CORE', true);
  Major versions (6.x → 7.x) should be tested on staging first before updating production.
• Plugins and themes: Enable auto-updates per-plugin in wp-admin → Plugins. For plugins where you need to vet changes first, set a weekly review reminder instead.
• PHP version: Running PHP 7.4 or earlier is a significant risk — PHP 7.4 reached end-of-life in November 2022 and no longer receives security patches. Check your PHP version in wp-admin → Site Health → Info. PHP 8.2 or 8.3 is the current supported range.
• Abandoned plugins: In wp-admin → Plugins, check the “Last Updated” date. A plugin with no updates in 2+ years and no active support forum is a liability — look for an actively maintained alternative.

Step 2: Enforce strong passwords across all user accounts

WordPress’s default password strength indicator suggests strong passwords but doesn’t enforce them. Any admin or editor account with a weak password is an entry point.

• Admin accounts: Use a password manager (Bitwarden, 1Password) to generate 20+ character random passwords. Never reuse passwords across sites.
• Enforce site-wide: The Password Policy Manager plugin (free) lets you set minimum length, required character types, and expiry periods for all user roles.
• Check for exposed credentials: The Have I Been Pwned API is integrated into some security plugins — it flags if any site account email has appeared in known data breaches.
• Remove unused accounts: Every admin account that isn’t actively used is an unnecessary attack surface. Delete old contributor, author, or admin accounts that are no longer needed.

Step 3: Enable two-factor authentication

Two-factor authentication (2FA) prevents an attacker from logging in even if they have a valid username and password. It’s the highest-ROI security addition for most WordPress sites because it neutralises credential-stuffing attacks entirely.

The two most common implementations:

• WP 2FA plugin (free, wordpress.org): Adds TOTP-based 2FA (Google Authenticator, Authy) and email OTP. Lets you enforce 2FA for specific roles (you can require it for admins and editors but make it optional for subscribers).
• Wordfence built-in 2FA: If you’re already running Wordfence, it includes 2FA without a separate plugin — enables TOTP + reCAPTCHA on the login form.

Configure 2FA to be mandatory for admin and editor roles. Subscribers and customers don’t need it unless the site handles sensitive user data (e-commerce, membership).

Step 4: Limit login attempts and change the login URL

WordPress’s default login page at /wp-login.php and /wp-admin/ receives constant brute-force traffic. Two quick measures cut this significantly:

Limit login attempts: Install Limit Login Attempts Reloaded (free). Set lockout after 3–5 failed attempts, with increasing lockout duration for repeat offenders. Block IP ranges that show repeated failed attempts.

Change the login URL: WPS Hide Login (free) changes /wp-login.php to a custom URL of your choice (e.g. /enter or /site-login). This won’t stop a determined attacker who knows the plugin, but it eliminates the large volume of automated bots targeting the default path. Store the new URL somewhere secure — if you forget it, you’ll need FTP/server access to deactivate the plugin.

Step 5: Install and configure a security plugin

A dedicated security plugin provides firewall protection, malware scanning, file integrity monitoring, and security hardening — all from a single dashboard. The three main options in 2026:

• Wordfence: The most widely used WordPress security plugin. The free version includes a web application firewall (WAF), malware scanner, login security, and live traffic monitoring. Wordfence’s threat intelligence is updated in real-time for paid users and with a 30-day delay for free users — meaning free-tier users get patches for known threats 30 days after release.
• Sucuri Security: Stronger at server-level protection and DDoS mitigation. Sucuri’s website firewall is a DNS-level proxy (like Cloudflare) that filters traffic before it reaches your server. More effective than a plugin-level firewall for high-traffic sites, but requires DNS changes.
• Solid Security (formerly iThemes Security): Better for sites that want a one-stop security hardening checklist — file permission fixes, database prefix changes, XML-RPC management, and user account security in a single plugin.

For a detailed comparison of what each plugin actually catches and misses, the WordPress security plugins comparison for 2026 covers Wordfence vs Sucuri vs Solid Security vs MalCare with feature-by-feature breakdowns.

Step 6: Force HTTPS and check your SSL configuration

If your site isn’t running on HTTPS, every login, form submission, and authenticated request is transmitted in plaintext. Most hosts provide free SSL certificates via Let’s Encrypt — there’s no excuse for HTTP in 2026.

Once you have an SSL certificate installed, force HTTPS everywhere:

// Add to wp-config.php:
define('FORCE_SSL_ADMIN', true);

// Add to .htaccess (Apache):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Also check:

• HTTP Strict Transport Security (HSTS) header — tells browsers to always use HTTPS for your domain, even if someone types the HTTP URL
• SSL Labs (ssllabs.com/ssltest) gives your SSL configuration an A–F grade and flags weak cipher suites or mixed content issues
• WordPress Address URL and Site URL in wp-admin → Settings → General should both start with https://

Step 7: Harden wp-config.php and file permissions

wp-config.php contains your database credentials and security keys — it should never be web-accessible. Add this to your .htaccess to block direct access:

<files wp-config.php>
order allow,deny
deny from all
</files>

Recommended file permissions for a WordPress installation:

• wp-config.php: 400 (owner read-only) or 440
• .htaccess: 644
• WordPress directories (wp-content/, wp-includes/): 755
• WordPress files: 644

Set permissions via SSH:

find /path/to/wordpress -type d -exec chmod 755 {} \;
find /path/to/wordpress -type f -exec chmod 644 {} \;
chmod 400 wp-config.php

Also add security keys to wp-config.php if they’re missing or outdated — generate fresh ones at api.wordpress.org/secret-key/1.1/salt/. Regenerating keys immediately invalidates all active sessions, which is useful after a suspected compromise.

Step 8: Disable XML-RPC if you don’t need it

XML-RPC is a legacy remote publishing protocol that WordPress keeps enabled by default. It’s been obsolete since the REST API shipped in WordPress 4.7, but it remains a common attack vector because it allows an attacker to attempt thousands of username/password combinations in a single HTTP request — bypassing normal login attempt limits.

Disable it in .htaccess:

<files xmlrpc.php>
order allow,deny
deny from all
</files>

Or via a filter in your theme’s functions.php:

add_filter('xmlrpc_enabled', '__return_false');

When to keep it on: Jetpack requires XML-RPC for some of its features. The Jetpack app and some older mobile publishing workflows also rely on it. If you’re not using any of these, disable it.

Step 9: Back up your site regularly and test the restores

A backup you’ve never tested restoring is not a real backup — it’s a hope. WordPress security incidents often go undetected for weeks, which means you need multiple restore points, not just yesterday’s backup.

A solid backup strategy:

• UpdraftPlus (free) or BackupBuddy (paid): automated scheduled backups of files + database
• Offsite storage: Send backups to Google Drive, S3, Backblaze B2, or Dropbox — never store them only on the same server you’re backing up
• Retention policy: Keep daily backups for 30 days, weekly backups for 3 months — this gives you a pre-infection restore point even for slow-moving compromises
• Test restores: Restore to a staging environment quarterly to confirm the backup is valid and you know the steps

The complete WordPress maintenance guide covers backup schedules, plugin configuration, and what to do when you need to restore — including the steps for handling a compromised site.

Step 10: Monitor your site with security logs and uptime alerts

Most WordPress sites run unmonitored — owners don’t know their site has been compromised until a visitor reports it or Google shows a “this site may be hacked” warning in search results. Proactive monitoring catches incidents early:

• Security audit log: WP Activity Log plugin records every admin action — user logins, plugin activations, post edits, settings changes. If someone does get in, you have a record of what they changed.
• File integrity monitoring: Wordfence and Sucuri both monitor core WordPress files for unexpected changes. Any modification to a core file outside of an official update is a red flag.
• Uptime monitoring: UptimeRobot (free for 50 monitors) pings your site every 5 minutes and emails you if it goes down. A sudden site outage can be the first sign of a security incident.
• Google Search Console alerts: Google notifies verified Search Console users when it detects malware or manual actions on a site. Verify your site if you haven’t already.

The full approach to monitoring before a problem occurs — including what to do if you find an infected file — is in the proactive WordPress security measures guide.

Security is a process, not a one-time setup

Running through these steps once hardens your current setup, but WordPress security requires ongoing attention: plugins need updating when vulnerabilities are disclosed, passwords need rotating if accounts are involved in data breaches, and new attack vectors emerge regularly.

A practical cadence: weekly plugin updates, monthly review of user accounts and access logs, quarterly backup restore test, and immediate action whenever a high-severity CVE is disclosed for a plugin you’re running (the WPScan vulnerability database and Wordfence’s threat intelligence both publish CVE alerts you can subscribe to).

For the full picture on what a hardened WordPress site looks like day-to-day — including wp-admin access controls, server-level configurations, and security response playbooks — see the guides to essential WordPress security practices and securing WordPress against modern threats in 2026.