The WordPress Hardening Checklist for 2026

The WordPress hardening checklist at a glance

Work from the top. The first items stop the most common attacks, and the later ones limit the damage if something slips through.

• Keep WordPress core, plugins, themes and PHP up to date, and delete what you do not use.
• Give every person their own account with the lowest role that does the job.
• Use long, unique passwords and turn on two-factor sign-in for administrators.
• Limit failed sign-ins and consider moving or restricting the login page.
• Switch off what you do not use: XML-RPC, the file editor, comments, application passwords.
• Stop the site giving away usernames and its version number.
• Serve the whole site over HTTPS and send security headers.
• Lock down file permissions and protect wp-config.php.
• Stop PHP from running in the uploads folder.
• Take backups you have actually tested restoring.
• Scan for malware and watch for file changes.
• Keep an activity log and get alerts you will read.

Updates and clean-up

Most hacked WordPress sites were running a plugin or theme with a known flaw that had already been fixed. Updating is the single most effective thing you can do.

WordPress installs minor security releases automatically by default. Plugins and themes are your job unless you turn on automatic updates for them. Run on a PHP version that still receives security fixes, and ask your host to move you if it does not.

1. 1Update core, then plugins, then themes. Take a backup first on any site that matters.
2. 2Delete plugins and themes you do not use. Deactivated code can still be attacked.
3. 3Remove anything abandoned: plugins that have not been updated in years or have been closed in the plugin directory.
4. 4Never install nulled (pirated) premium plugins or themes. They are a common way malware gets in.

Accounts and passwords

Stolen and guessed passwords remain the most common way in. Fix the human side before the technical side.

• No shared logins. Every person gets their own account so you can see who did what and remove one person cleanly.
• Least privilege: authors and editors do not need the Administrator role.
• Do not use admin as a username. If you have such an account, create a new administrator, move the content across and delete the old one.
• Require long passwords or passphrases, and use a password manager.
• Turn on two-factor authentication for every administrator, then everyone who can publish or manage users.
• Review the user list every few months and remove accounts that are no longer needed.

Login protection

Your login page faces the whole internet. Slow guessers down and give them less information.

• Lock out an address after a few failed attempts, for example five tries in five minutes followed by a lockout of fifteen minutes.
• Show one generic error for a wrong username and a wrong password.
• Optionally move the login page to a custom address or restrict it by IP address.
• Add CAPTCHA to the login, registration and password reset forms if bots are a problem.

Switch off what you do not use

Every feature that is switched on can be attacked. Turn off the ones your site never uses.

The code editors under Appearance and Plugins let an administrator edit PHP in the browser. If an attacker gets into an admin account, that is the quickest route to a back door. A single constant removes them.

• XML-RPC: an old remote publishing interface that allows many password guesses in one request. Disable it unless a tool you use needs it.
• Application passwords: separate credentials for apps that bypass two-factor sign-in. Disable them if nothing uses them.
• Comments and pingbacks: disable them if you do not run a discussion on your site.
• User enumeration and version output: stop handing out usernames and the WordPress version number.

define( 'DISALLOW_FILE_EDIT', true );

HTTPS and security headers

Every page, including the admin area, should load over HTTPS. Force it for sign-ins and the admin with one line in wp-config.php, and redirect all http:// traffic to https:// at the server.

Security headers tell browsers how to treat your pages. The easy ones are X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy. HSTS and a Content Security Policy come later and need more care.

define( 'FORCE_SSL_ADMIN', true );

Files, permissions and wp-config.php

On most servers, directories should be 755 and files 644. The wp-config.php file holds your database password and secret keys, so make it readable only by the account that runs the site, usually 640 or 600. Never use 777.

Stop PHP from running in wp-content/uploads/. Nothing legitimate needs to execute there, and attackers love to drop scripts into it.

<FilesMatch "\.(php|phtml|php[0-9])$">
  Require all denied
</FilesMatch>

Backups, monitoring and alerts

Hardening reduces risk but never removes it. Plan for the day something gets through.

• Keep backups of the database and wp-content, stored away from the server, and practice restoring one.
• Scan for malware on a schedule and watch for files that change when you did not change them.
• Keep an activity log of sign-ins, setting changes and user changes.
• Send alerts to an inbox somebody reads, and review them weekly.
• Write down your recovery steps now, including who to call and where the backups live.