WordPress Security Checklist for 2026: 25 Essential Steps
A secure WordPress site needs layered protection: maintained software, strong identity controls, trustworthy hosting, recoverable backups, reduced attack surface, and continuous monitoring. No single plugin replaces these fundamentals — this site, for example, runs Wordfence for firewall/malware scanning and Really Simple SSL for HTTPS enforcement, and neither one is a substitute for the update discipline and access controls below. Use this checklist for a new build, quarterly review, or post-incident hardening.
Accounts and Login Security
- Require unique passwords generated and stored by a password manager.
- Enable multi-factor authentication for administrators, editors, hosting, DNS, CDN, email, and domain registrar accounts.
- Remove unused users and immediately revoke access when a contractor or employee leaves.
- Apply least privilege: most content users do not need Administrator access.
- Protect login endpoints with rate limiting and bot controls instead of relying only on a renamed login URL.
WordPress, Plugin, and Theme Maintenance
- Run a supported WordPress version and install security releases promptly.
- Update plugins and themes after testing business-critical changes on staging.
- Delete inactive extensions and themes that are not required for rollback.
- Choose maintained software with recent releases, clear ownership, and a responsible security process.
- Inventory custom code and review snippets, must-use plugins, child themes, and integrations.
Hosting and Transport Protection
- Use a currently supported PHP version that is compatible with your stack.
- Force HTTPS across the site and renew TLS certificates automatically.
- Use SFTP or SSH instead of unencrypted FTP.
- Review file ownership and permissions; avoid blanket 777 permissions.
- Put a web application firewall or CDN in front of public sites and configure it for your traffic rather than accepting every default.
Backups and Recovery
- Back up files and databases automatically at a frequency that matches how often data changes.
- Store copies off-site so a hosting compromise cannot erase the originals.
- Encrypt sensitive backups and tightly control access to them.
- Test restorations on an isolated environment and record the result.
- Write an incident plan listing who can isolate, restore, rotate credentials, and communicate.
Application Hardening and Monitoring
- Disable dashboard file editing with
DISALLOW_FILE_EDIT— this closes off a specific, real attack path: an attacker who compromises one admin account can otherwise run arbitrary PHP directly through Appearance → Theme Editor, no file upload needed. - Restrict or disable XML-RPC if no connected service requires it.
- Filter uploads and form input and keep spam protection current.
- Monitor file changes, admin creation, failed logins, uptime, DNS, and TLS status.
- Review logs and scan externally so alerts are not dependent on a potentially compromised WordPress installation.
The two wp-config.php constants worth adding as a baseline:
define( 'DISALLOW_FILE_EDIT', true ); // removes Theme/Plugin Editor from wp-admin
define( 'FORCE_SSL_ADMIN', true ); // forces HTTPS for wp-admin and login, even if a stray http:// link existsDISALLOW_FILE_MODS is a stricter sibling that also blocks plugin/theme installs and updates from wp-admin entirely — only worth it if updates are already managed some other way (staging + deploy pipeline, WP-CLI), since otherwise it just gets in the way of routine maintenance.
What to Do If WordPress Is Hacked
Preserve logs, place the site in a controlled maintenance state, and take a forensic copy before cleanup. Rotate hosting, WordPress, database, SFTP, API, email, DNS, and registrar credentials from a clean device. Identify the entry point, replace compromised code with verified packages, restore clean data where appropriate, patch the vulnerability, and monitor closely after relaunch.
Simply deleting visible spam is not enough; persistence can remain in administrator accounts, scheduled tasks, must-use plugins, uploads, or server configuration.
WordPress Security FAQ
Do I need a WordPress security plugin?
A well-chosen plugin can add monitoring, login controls, and firewall features, but it complements—not replaces—updates, MFA, backups, secure hosting, and sound access management.
How often should I review security?
Monitor continuously, install urgent security fixes promptly, and perform a documented access and configuration review at least quarterly.
For a broader read on where a site stands beyond just security, our free Full Site Audit checks performance, SEO, and accessibility together.
