WordPress Security Checklist 2026: 15 Steps in Priority Order

Quick answer: Secure WordPress in 15 steps, in priority order: updates, 2FA, strong passwords, a security plugin, off-server backups, HTTPS, login protection, least-privilege users, file editing disabled, XML-RPC off, database prefix changed, security headers, file permissions, uptime monitoring, and a quality host. Steps 1-6 block ~95% of attacks.

Tier 1: The Non-Negotiables (Do Today)

• 1. Auto-updates on. Plugins, themes, and minor core releases. Most hacks exploit known, patched holes.
• 2. Two-factor authentication. Blocks credential stuffing even if your password leaks — see our 2FA setup guide.
• 3. Unique strong passwords. A password manager, not "WordPress2026!". Compromised credentials are the #2 attack vector.
• 4. A security plugin. Wordfence or Solid Security for firewall + scanning + login hardening — compared in our security plugins ranking.
• 5. Off-server backups. Daily, stored off your hosting account. If the server dies or gets wiped, your backup survives.
• 6. HTTPS everywhere. Free SSL via your host or Cloudflare — non-negotiable for logins alone.

Tier 2: Hardening (This Week)

• 7. Limit login attempts. Brute-force bots hammer wp-login.php; rate-limiting stops them cold.
• 8. Least-privilege users. Nobody gets Administrator who doesn't need it. Authors write; admins administer.
• 9. Disable file editing. define('DISALLOW_FILE_EDIT', true) in wp-config — stops attackers editing theme files from wp-admin.
• 10. Disable XML-RPC if unused — it's a brute-force amplifier most sites don't need.
• 11. Change the table prefix on new installs (wp_ → random) — minor but free hardening.

Tier 3: Infrastructure (This Month)

• 12. Security headers. X-Frame-Options, X-Content-Type-Options — most security plugins or Cloudflare can set them.
• 13. File permissions. 644 files / 755 directories; never 777.
• 14. Uptime + file-change monitoring. Know within minutes when something changes or goes down.
• 15. A host that helps. Server-level firewalls, malware scanning, and account isolation matter — cheap shared hosting with weak isolation is a real attack vector.

Already Hacked?

Different playbook — isolate, clean, rotate credentials, restore. Our hacked site recovery guide walks the full protocol. And for the domain side of security, WHOIS privacy keeps your registration details out of attackers' hands.