How to secure a WordPress site: a practical 2026 guide

You secure a WordPress site with long passwords and 2FA on the admin account, up-to-date core, themes and plugins, SSL across the whole site, daily backups kept off the server, and limits on login attempts. None of this needs sysadmin skills. WordPress runs a good share of the world's websites, which makes it the favourite target of automated attacks, so below are the steps in the order I'd take them and why each one matters.

Why WordPress sites get attacked

Most attacks aren't personal. Bots scan the internet nonstop and try the same known vulnerabilities on thousands of sites a minute. They look for weak passwords, outdated plugins or themes, and exposed login forms. You don't need to be an important target to get hit; being vulnerable is enough.

A compromised site has real consequences: spam pages and redirects to shady sites, phishing emails sent from your server, stolen customer data and, very often, a Google penalty that cuts your traffic. Cleaning up costs far more time and money than prevention, so treat WordPress security as a routine rather than something you react to after an incident.

Strong passwords and two-factor authentication (2FA)

The administrator account is your first line of defence. A reused or easy-to-guess password is the most common way in.

• Use long, unique passwords for every account (WordPress admin, hosting panel, email, FTP). At least 16 characters, generated with a password manager.
• Drop the "admin" username. Create a new administrator account with a different name, then delete the default one.
• Turn on 2FA (two-factor authentication) for the admin account, using an authenticator app. Even if someone learns your password, they can't get in without the second factor.
• Keep administrators few. Every high-privilege account is one more door. Give each user only the role they need (author, editor).

Keep core, themes and plugins updated

Many hacked WordPress sites were running an old version of a plugin with a known vulnerability that had already been fixed. Attackers don't discover anything new; they use published flaws that already have a patch.

How to handle updates

• Update the WordPress core, themes and plugins as soon as new versions come out, especially those marked as security fixes.
• Delete what you don't use. An inactive plugin or theme is still code on the server and can be exploited. Uninstall it completely rather than just deactivating it.
• Install only from trusted sources: the official WordPress directory or well-known developers. "Nulled" plugins (pirated copies of premium ones) very often ship with a backdoor.
• Test before a major update if you run an important online store: with a recent backup you can roll back quickly if the update breaks something.

SSL, encrypted connections and secure transfers

An SSL certificate encrypts traffic between the visitor and the site, so passwords and payment details can't be intercepted. In 2026 SSL is standard: browsers flag sites without HTTPS as not secure, and Google ranks them lower.

Check that the whole site runs on HTTPS, not just the checkout page, and that HTTP redirects to HTTPS automatically. With decent hosting, installing and renewing the certificate is automatic. See how an included SSL certificate is issued automatically, with no renewals for you to track. Beyond SSL, stop using unencrypted FTP and use SFTP when you upload files.

Daily backups: your safety net

No measure protects you 100%. What separates a small incident from a disaster is the backup. With a recent copy that works, a hacked site is restored in minutes; without one, you can lose years of work for good.

• Run automatic daily backups of files and the database. A manual "once a month" backup won't help when you really need it.
• Keep copies off the server. A backup stored only on the same server disappears with it if the server is compromised or fails.
• Test a restore at least once. A backup you can't recover from isn't a backup.
• Keep several versions (the last 7–30 days), because an infection may only be noticed days later.

Limiting logins and stopping brute-force attacks

The wp-login.php page is hit constantly by bots trying thousands of password combinations. A few simple measures cut the risk a lot:

• Limit login attempts and temporarily block IPs that get the password wrong repeatedly.
• Add 2FA: even if the bot guesses the password, it stops at the second factor.
• Change the default login address or protect the admin area with an extra server-level password.
• Disable file editing from the dashboard (the DISALLOW_FILE_EDIT constant), so an attacker who gets in can't inject code straight from the interface.

Filtering has to be done carefully so you don't lock out real customers. That's why the firewall and protection rules are better configured at the hosting level, not only through a plugin that also adds load to the site.

The role of hosting: much of your security sits on the server

You can do everything right in WordPress and still be exposed if the server is poorly secured or overcrowded. Good hosting does part of the work in the background:

• A server-level firewall that stops attacks before they reach WordPress.
• Account isolation, so a compromised neighbouring site on the same server can't reach yours.
• Current, updated PHP versions, because old PHP is a major source of vulnerabilities.
• Automatic backups and monitoring, plus technical support that responds quickly to an incident.
• NVMe and LiteSpeed, which aren't only about speed: a stable server copes better with waves of hostile traffic.

Secure WordPress hosting turns many of the measures above into default settings instead of tasks you tick off by hand. So choosing a host is a security decision as well as a price one.

Quick WordPress security checklist

• Long, unique passwords + 2FA on the admin account
• No "admin" user, and the minimum role needed for each account
• Core, themes and plugins updated; unused ones deleted
• SSL active across the whole site, with an automatic HTTPS redirect
• Automatic daily backups, stored off the server and tested
• Limited login attempts + a protected admin area
• Hosting with a firewall, isolation and current PHP

WordPress security is a routine: you set it up once and then keep it going. Tick off the steps above and the risk drops a lot. The simplest start is to move your site to secure WordPress hosting with a firewall, backups and SSL included, so part of this list happens automatically.