Securing WordPress in 2026: the complete guide

WordPress security isn't optional — it's mandatory as soon as a site generates traffic or revenue. Every month I fix compromised sites (injected content, malicious redirects, a store drained by a card skimmer) that could have avoided the worst with a few basic measures, often neglected for lack of time or knowledge. Here's the complete guide, from the simplest to the most technical.

1. Strong authentication

Systematically enable two-factor authentication (2FA) for every account with an administrator or editor role: a plugin like Wordfence or Two Factor offers simple integration with an authenticator app. Strictly limit login attempts (Wordfence, Limit Login Attempts Reloaded), with automatic IP banning after 3 to 5 failures. Also ban generic usernames like "admin", which remain the first target of automated brute-force attacks.

2. File and configuration hardening

Disable file editing directly from the wp-admin interface by adding the DISALLOW_FILE_EDIT constant to wp-config.php: this prevents an attacker who's gained admin access from directly editing theme or plugin code. Protect the wp-config.php file itself with an .htaccess rule blocking direct access. Apply strict permissions on files (644) and folders (755), and never leave a folder writable at 777, even temporarily.

3. Rigorous update management

Enable automatic minor updates to WordPress core (security patches), which carry no risk of breakage. For major updates and plugins, plan a test on a staging environment before applying to production. Audit all your active extensions monthly: a plugin abandoned for over a year without an update is a security risk that grows with time, and should be replaced or removed. A site with 40 installed plugins, 15 of them inactive, is an entry point I systematically close for my clients.

4. Web application firewall and monitoring

A front-facing web application firewall (WAF), like the one included free in Cloudflare's basic plan, filters out a large share of malicious traffic before it even reaches the server. On top of that, Wordfence or Sucuri run regular malware scans of the site's files, with immediate alerts on any suspicious change to a core file. Set up email notifications for any detected anomaly: login from an unusual country, system file modification, abnormal traffic spike.

5. Reliable, tested backups

Automated, off-site backups (for example UpdraftPlus paired with Google Drive or Amazon S3 storage) should run at least once a day, covering both the database and files. The 3-2-1 rule remains the reference: 3 copies of the data, on 2 different media, with 1 off-site. The most commonly neglected point: actually test the restore process at least once a quarter. A backup that's never been tested is a false sense of security.

6. SSL certificate and security headers

HTTPS must be active across the entire site without exception, with an automatic HTTP-to-HTTPS redirect. Add the recommended security headers (Content-Security-Policy, X-Frame-Options, X-Content-Type-Options) via server configuration or a dedicated plugin, to reduce the attack surface against cross-site scripting and clickjacking.

What to do if you're already compromised

If the site is already compromised, isolate it immediately (maintenance mode, restricted access), change every password (admin, FTP, database), restore from a clean backup predating the compromise if possible, then identify the exploited flaw before going back live to avoid an immediate repeat. On sites I handle after a hack, the cause is an outdated plugin or a weak password in 70% of cases.