Securing a WordPress website is less about finding one perfect security plugin and more about reducing the number of ways an attacker can get in, limiting what a compromised account or component can do, and making recovery possible when prevention fails. The most important measures are straightforward: keep WordPress and its extensions updated, protect administrator accounts with strong authentication and MFA, use HTTPS, remove software you do not need, maintain tested backups, and choose hosting with appropriate isolation and security controls.
WordPress security also requires ongoing maintenance. As of September 22, 2026, the latest WordPress release is 7.1.2, a security release containing a fix for a critical-severity vulnerability. That is a useful reminder that even a well-configured website can become vulnerable when its underlying software falls behind. WordPress itself recommends keeping software current, and its security team continues to issue security releases and backports for some older supported branches.
Start with the WordPress software itself
WordPress is not inherently insecure simply because it is widely used. Its large ecosystem is one of its strengths, but it also means that security depends on the core software, plugins, themes, hosting environment and administrator practices working together.
The first step is therefore to make sure the entire installation is maintained.
That means keeping:
- WordPress core updated
- Plugins updated
- Themes updated
- PHP and other server components supported by your host
- Security-related services and integrations maintained
The WordPress project recommends using the latest release, and recent WordPress releases demonstrate why: security fixes are regularly shipped when vulnerabilities are discovered.
Do not ignore plugin updates
Plugins are particularly important because every installed plugin adds software to your website.
WordPress recommends keeping plugins up to date and provides automatic-update controls for individual plugins. Automatic updates can reduce the period during which a known vulnerability remains unpatched, although backups and appropriate testing remain important.
A useful rule is:
If you do not need a plugin, remove it.
Do not assume that an inactive plugin is harmless simply because visitors cannot use its features. Unnecessary software increases the amount of code you have to maintain and monitor.
The same principle applies to themes.
Keep the active theme updated and remove themes you have no reason to retain.
Use strong administrator authentication
An attacker who obtains a WordPress administrator account may have enough access to install plugins, modify content, change settings or alter website files.
WordPress’s hardening guidance specifically recommends strong passwords and additional authentication measures such as two-step authentication.
Avoid passwords based on:
- Your name
- Your business name
- Your domain
- Common dictionary words
- Easily guessed personal information
- Passwords reused on other services
A password manager can make unique, long passwords practical without requiring you to memorize each one.
Enable multifactor authentication
MFA adds another authentication factor beyond the password.
This matters because a stolen password is no longer necessarily enough to access the account.
CISA recommends requiring MFA wherever possible and identifies phishing-resistant security keys as one of the strongest available options, followed by other authenticator-based methods.
For a WordPress site, prioritize MFA for:
- Administrators
- Hosting accounts
- Domain registrar accounts
- Email accounts associated with administration
- Database or server management accounts
- Other systems that can change the website
Protecting the hosting and email accounts is especially important. A secure WordPress password does little good if an attacker can reset it through a compromised email account.
Do not give everyone administrator privileges
WordPress uses roles and capabilities to control what users can do.
Not every person who publishes an article needs permission to install plugins or change site configuration.
Use the least amount of access necessary.
For example:
- Writers may need publishing capabilities.
- Editors may need broader content-management access.
- Developers may need technical access.
- Administrators should be limited to people who genuinely require it.
Reducing administrator accounts reduces the number of credentials that could provide complete control of the site.
Regularly review the user list and remove accounts that are no longer required.
Secure your hosting account
WordPress security does not stop at the WordPress dashboard.
Your hosting account can provide access to:
- Website files
- Databases
- DNS or related configuration
- Backups
- Server settings
- Other websites on the account
Use a unique password and MFA for the hosting account whenever available.
For file transfers, WordPress recommends using SFTP rather than unencrypted FTP when the host supports it. SFTP encrypts credentials and other data transferred between your computer and the website.
If you are choosing a new host, security features should be part of the decision rather than an afterthought.
Use HTTPS correctly
HTTPS protects communication between visitors and your website through TLS.
For WordPress, HTTPS should cover:
- The public website
- WordPress administration
- Login pages
- Forms
- Ecommerce transactions
- API connections
Make sure HTTP traffic redirects appropriately to HTTPS and avoid mixed-content problems where pages load important resources over insecure HTTP.
HTTPS does not make WordPress immune to hacking. It protects the connection between the visitor and website; it does not patch vulnerable plugins or stop a compromised administrator from modifying the site.
Keep reliable backups
Backups are your recovery mechanism when prevention fails.
A useful WordPress backup should account for both:
- Website files
- Database content
Depending on the site, you may also need to consider email, custom server configuration and other externally stored data.
Do not rely on a backup simply because your hosting dashboard says “backup successful.”
Test restoration.
A backup that cannot be restored is an assumption rather than a dependable recovery mechanism.
For important websites, maintain copies that are separated from the live hosting environment. This reduces the risk of one compromised hosting account destroying both the website and its recovery copies.
Use a security plugin or WAF for the right reasons
Security plugins can provide useful capabilities such as:
- Malware scanning
- Login protection
- File-change monitoring
- Firewall rules
- Security alerts
- Vulnerability detection
A Web Application Firewall (WAF) can also filter certain malicious requests before they reach the WordPress application.
WordPress’s own hardening documentation describes both WordPress-level firewall plugins and server or reverse-proxy WAFs as possible layers of protection.
But installing several security plugins does not automatically create better security.
Multiple plugins may duplicate functions, introduce compatibility problems or create additional software that must itself be maintained.
Choose security tools according to the risks you actually need to address.
Protect the WordPress file system
WordPress files should not generally be writable by everyone on the server.
Incorrectly permissive permissions can make it easier for an attacker or compromised process to modify files.
WordPress’s documentation recommends restrictive permissions appropriate to the hosting environment and specifically warns against unnecessarily permissive settings such as 777. It also notes that wp-config.php deserves particular protection because it contains sensitive configuration information.
Do not change permissions blindly, however.
Hosting environments differ, and incorrect permissions can break updates or take a website offline.
If you are unsure, ask your hosting provider or a qualified administrator to verify the configuration.
Disable unnecessary file editing
WordPress allows administrators to edit plugin and theme files from the dashboard.
That can be convenient for development, but it also creates another way for someone with a compromised administrator account to modify PHP code.
WordPress documents the DISALLOW_FILE_EDIT setting as a way to disable this dashboard-based editing capability.
For production websites where code is managed through controlled deployment or SFTP, disabling the built-in editor can reduce the consequences of a compromised administrator account.
This is a hardening measure, not a substitute for protecting the account itself.
Be careful with plugins that execute code
Plugins can legitimately require substantial privileges.
But a plugin that can execute arbitrary PHP or write broadly to the filesystem can magnify the consequences of a compromise.
WordPress’s hardening guidance specifically warns about plugins that allow arbitrary code execution and recommends checking the legitimacy of plugins that require extensive write access.
Before installing a plugin, consider:
- Is it actually necessary?
- Is it actively maintained?
- Does the developer respond to security issues?
- Is it from a trustworthy source?
- Does it request unusually broad permissions?
- Can the same function be achieved without adding another dependency?
The smallest practical software footprint is generally easier to maintain.
Protect wp-config.php
The wp-config.php file contains sensitive configuration information, including database connection credentials.
It therefore deserves stronger protection than ordinary website content.
WordPress documents options for protecting the file and notes that it can be placed one directory above the WordPress installation in suitable configurations. It also recommends restricting who can read the file.
Do not copy configuration snippets from random security blogs without understanding your server environment.
A change that works on Apache may not apply to an Nginx configuration, and an incorrect permission change can cause problems.
Use a secure database configuration
The WordPress database contains valuable information, including content, users and configuration data.
Use a database account with only the permissions required by the application where practical.
Do not expose database administration interfaces unnecessarily to the public internet.
And never publish database credentials in source code, public repositories or support forums.
The database should also be included in your backup and recovery strategy.
Consider rate limiting and login protection
Attackers can repeatedly attempt to log in to WordPress accounts.
Rate limiting, login protection and other anti-abuse controls can make automated attacks more difficult.
Depending on your setup, these controls may be implemented at:
- The hosting layer
- A WAF or reverse proxy
- A security plugin
- The web server
- WordPress itself
The best location depends on your infrastructure.
Blocking abusive traffic before it reaches WordPress is generally more efficient than forcing WordPress to process every malicious request.
Protect the website from DDoS attacks
DDoS protection addresses a different problem from malware and account compromise.
A DDoS attack attempts to overwhelm the website or its infrastructure with traffic or requests.
For public-facing websites, particularly businesses and ecommerce operations, protection at the network or edge layer can prevent attack traffic from consuming the same resources required by legitimate visitors.
Your hosting provider or CDN may provide DDoS mitigation as part of the infrastructure.
Ask exactly what is covered rather than treating “DDoS protection” as a universal feature.
Monitor the website for suspicious changes
Prevention is only part of security.
You also need to know when something goes wrong.
Useful monitoring can detect:
- Unexpected administrator accounts
- Changes to important files
- New plugins
- Plugin or theme modifications
- Suspicious login activity
- Malware indicators
- Unexpected redirects
- Search-engine spam
- Sudden traffic changes
WordPress’s hardening documentation includes logging and monitoring among its recommended security considerations.
The objective is not to generate thousands of alerts.
It is to identify meaningful changes quickly enough to investigate them.
Be careful with administrator email accounts
The email address attached to a WordPress administrator account can become a critical recovery point.
If an attacker controls that email account, they may be able to reset passwords or intercept security notifications.
Protect the email account with:
- A unique password
- MFA
- Recovery methods you control
- Regular account-security reviews
This is one reason website security should be treated as a broader system rather than a WordPress-only problem.
Keep your domain registrar secure
Your domain registrar is another high-value target.
Someone who gains control of the domain can potentially redirect visitors away from the website or interfere with services associated with the domain.
Use MFA and a strong, unique password on the registrar account.
Where supported, consider registrar-level protections such as domain transfer locks and appropriate account recovery controls.
For an important business website, domain security can be just as consequential as WordPress security.
Do not install pirated themes or plugins
“Free” software from unofficial sources can create a serious security problem.
A modified plugin or theme may contain malicious code, hidden administrator accounts, backdoors or other unwanted functionality.
The apparent saving can therefore turn into a website compromise.
Obtain WordPress extensions from legitimate sources and investigate the developer and maintenance history before installing them.
Review unused users and access regularly
Security is not a one-time installation task.
People leave companies. Developers finish projects. Agencies change. Temporary accounts become permanent.
Review:
- WordPress users
- Hosting users
- SFTP accounts
- Database accounts
- Domain access
- Security-service accounts
- API keys
Remove access that is no longer necessary.
If a person no longer needs administrative privileges, reducing their permissions is preferable to leaving the account untouched indefinitely.
What to do if your WordPress site is hacked
Do not immediately assume that deleting the homepage or reinstalling WordPress has solved the problem.
A compromise can involve:
- Malicious files
- Rogue administrator accounts
- Modified plugins
- Modified themes
- Database changes
- Stolen credentials
- Backdoors
- Compromised hosting accounts
A sensible incident response starts by containing the problem.
Depending on the situation, that can include:
- Taking appropriate containment measures.
- Preserving relevant logs and evidence.
- Changing compromised credentials.
- Checking administrator accounts.
- Identifying the vulnerability or entry point.
- Removing malicious code.
- Updating vulnerable software.
- Restoring from a known-clean backup when appropriate.
- Checking the hosting and domain accounts.
- Monitoring the site after recovery.
If you cannot confidently determine what was compromised, professional incident-response assistance may be warranted.
A practical WordPress security checklist
| Security area | What to check | Why it matters |
|---|---|---|
| WordPress core | Run a current supported release | Security fixes address newly discovered vulnerabilities |
| Plugins and themes | Update them and remove unnecessary components | Reduces exposure to vulnerable or abandoned software |
| Administrator accounts | Use unique passwords and MFA | Limits damage from stolen credentials |
| User permissions | Give users only the access they need | Reduces the impact of account compromise |
| HTTPS | Use correctly configured TLS | Protects traffic between visitors and the site |
| Backups | Maintain multiple recovery points and test restoration | Provides a recovery path after failure or compromise |
| Hosting | Use secure administration and SFTP where available | Protects infrastructure-level access |
| File permissions | Avoid unnecessarily writable files and directories | Limits unauthorized modification |
| WAF/security controls | Filter malicious requests where appropriate | Can block some attacks before WordPress processes them |
| Monitoring | Watch for suspicious accounts, files and activity | Improves detection and response time |
| Domain and email | Protect registrar and recovery accounts with MFA | Prevents attackers bypassing WordPress through related services |
How often should you review WordPress security?
Security maintenance should happen continuously, but the depth of the review can vary.
Every day or automatically: monitor backups, security alerts and important availability signals.
Regularly: install security updates, review failed logins and investigate unusual changes.
Periodically: audit plugins, themes, users, administrator privileges and hosting access.
After major changes: create a backup, verify the site and review security settings.
After an incident: investigate the entry point rather than simply cleaning up visible damage.
Automation is valuable because it reduces dependence on someone remembering every task.
WordPress supports automatic updates for plugins and themes, although its documentation recommends having reliable backups so changes can be rolled back if necessary.
The most important WordPress security decision
There is no single setting that makes a WordPress website secure.
Security comes from layers.
An updated WordPress installation reduces exposure to known vulnerabilities. Carefully selected plugins reduce unnecessary attack surface. MFA protects privileged accounts. HTTPS protects communications. A WAF can filter certain attacks. Secure hosting limits infrastructure risks. Monitoring helps detect problems. Tested backups provide a route back after something goes wrong.
The most useful approach is therefore to look for gaps between those layers rather than searching for a magic security plugin. A website with excellent malware scanning but an unprotected administrator account still has a major weakness; a site with MFA but outdated plugins has another.
As WordPress continues to ship security releases—including the critical fix in version 7.1.2 released on September 22, 2026—keeping the software current remains an ongoing requirement rather than a one-time hardening exercise.
The long-term goal is simple: make unauthorized access harder, limit what an attacker can do if one layer fails, detect problems quickly, and ensure you can recover without depending entirely on the compromised system. That is a much more durable security strategy than relying on any individual plugin, setting or hosting feature.