WordPress Security Guide: 20 Steps to Lock Down Your Site

WordPress powers 43% of the web, making it a prime target for attackers. The good news: most WordPress hacks exploit known, preventable vulnerabilities. This 20-step checklist hardens your site against the vast majority of attacks.

Foundation: Updates and Access

1. Keep WordPress core updated — enable auto-updates for minor versions. 2. Update plugins and themes promptly; outdated code is the #1 attack vector. 3. Use strong unique passwords with a password manager. 4. Enable two-factor authentication via a plugin like WP 2FA.

Admin Hardening

5. Change the admin username from “admin” to something unique. 6. Limit login attempts (5 max) to block brute force. 7. Add a custom login URL with WPS Hide Login. 8. Disable XML-RPC if not needed — it’s a brute-force amplifier.

File and Server Security

9. Set correct file permissions (755 dirs, 644 files). 10. Disable file editing in wp-admin by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php. 11. Use HTTPS everywhere with a valid SSL certificate. 12. Protect wp-config.php with server rules.

Plugins and Monitoring

13. Install a security plugin (Wordfence or Sucuri). 14. Enable a firewall — WAF blocks malicious traffic before it reaches WordPress. 15. Set up malware scanning on a schedule. 16. Monitor file changes with an integrity checker.

Backup and Recovery

17. Automate offsite backups (see our backup guide). 18. Keep backups for 30+ days. 19. Document your recovery plan — know exactly how to restore. 20. Use a staging site to test updates safely.

Frequently Asked Questions

Is a security plugin enough? A plugin is essential but not sufficient. Combine it with strong passwords, 2FA, updates, and backups. Security is layered — no single tool protects everything.

How often do I need to scan? Daily automated scans are ideal. Most security plugins run them on a schedule and email alerts for suspicious activity.

What if my site is already hacked? Immediately change all passwords, restore from a clean backup, update everything, and scan. Our malware removal guide walks through this step by step.

Conclusion

WordPress security is prevention, not reaction. Work through these 20 steps — start with updates and strong passwords, add a firewall and backups, and you’ll be protected against 99% of attacks. Security isn’t optional in 2026.