A secure WordPress site in 2026 needs layered protection: maintained software, strong identity controls, trustworthy hosting, recoverable backups, reduced attack surface, and continuous monitoring. No single plugin can replace these fundamentals. Use this checklist for a new build, quarterly review, or post-incident hardening.

Accounts and Login Security

1. Require unique passwords generated and stored by a password manager.
2. Enable multi-factor authentication for administrators, editors, hosting, DNS, CDN, email, and domain registrar accounts.
3. Remove unused users and immediately revoke access when a contractor or employee leaves.
4. Apply least privilege: most content users do not need Administrator access.
5. Protect login endpoints with rate limiting and bot controls instead of relying only on a renamed login URL.

WordPress, Plugin, and Theme Maintenance

6. Run a supported WordPress version and install security releases promptly.
7. Update plugins and themes after testing business-critical changes on staging.
8. Delete inactive extensions and themes that are not required for rollback.
9. Choose maintained software with recent releases, clear ownership, and a responsible security process.
10. Inventory custom code and review snippets, must-use plugins, child themes, and integrations.

Hosting and Transport Protection

11. Use a currently supported PHP version that is compatible with your stack.
12. Force HTTPS across the site and renew TLS certificates automatically.
13. Use SFTP or SSH instead of unencrypted FTP.
14. Review file ownership and permissions; avoid blanket 777 permissions.
15. Put a web application firewall or CDN in front of public sites and configure it for your traffic rather than accepting every default.

Backups and Recovery

16. Back up files and databases automatically at a frequency that matches how often data changes.
17. Store copies off-site so a hosting compromise cannot erase the originals.
18. Encrypt sensitive backups and tightly control access to them.
19. Test restorations on an isolated environment and record the result.
20. Write an incident plan listing who can isolate, restore, rotate credentials, and communicate.

Application Hardening and Monitoring

21. Disable dashboard file editing with DISALLOW_FILE_EDIT when deployments are managed outside WordPress.
22. Restrict or disable XML-RPC if no connected service requires it.
23. Filter uploads and form input and keep spam protection current.
24. Monitor file changes, admin creation, failed logins, uptime, DNS, and TLS status.
25. Review logs and scan externally so alerts are not dependent on a potentially compromised WordPress installation.

What to Do If WordPress Is Hacked

Preserve logs, place the site in a controlled maintenance state, and take a forensic copy before cleanup. Rotate hosting, WordPress, database, SFTP, API, email, DNS, and registrar credentials from a clean device. Identify the entry point, replace compromised code with verified packages, restore clean data where appropriate, patch the vulnerability, and monitor closely after relaunch.

Simply deleting visible spam is not enough; persistence can remain in administrator accounts, scheduled tasks, must-use plugins, uploads, or server configuration.

WordPress Security FAQ

Do I need a WordPress security plugin?

A well-chosen plugin can add monitoring, login controls, and firewall features, but it complements—not replaces—updates, MFA, backups, secure hosting, and sound access management.

How often should I review security?

Monitor continuously, install urgent security fixes promptly, and perform a documented access and configuration review at least quarterly.