How to Secure a WordPress Site: The 2026 Guide

How secure is WordPress?

WordPress core is secure. It powers more than 40% of the web, the core team patches it constantly, and direct exploits of core code are rare.

The honest picture from our support desk, across almost 400 Australian business websites and more than 44,000 support conversations, is that risk concentrates in three places:

• Plugins and themes. Third-party code is where vulnerabilities live. The more you install, the larger your attack surface.
• Credentials. Weak, reused or shared passwords on admin accounts. Attackers do not break in; they log in.
• Neglect. Sites nobody maintains. Updates pile up, an abandoned plugin ships a vulnerability, and months later the site is serving spam.

That is good news. All three are controllable, and none of them requires you to write code.

What WordPress attacks actually look like

Security guides love exotic attack names. Here is what actually lands in a support inbox, in rough order of frequency:

And one that surprises people: a meaningful share of "my website has been hacked" reports we investigate turn out to be something else entirely. Usually a spoofed email, a scam vulnerability notice, or a third-party scanner flagging something harmless. The two sections after the security setup cover exactly how to triage those.

The 14-point WordPress security setup

Security works as layers, not silver bullets. Each layer stops what the previous one misses. Work through them in order: the earlier layers deliver the most protection per hour of effort.

Layer 1: Secure foundations

1. Choose hosting that takes security off your plate. Your host is your first line of defence. Look for server-level malware scanning, isolated site environments, automatic daily backups and a firewall included. Cheap shared hosting puts your site on a server with hundreds of strangers, and one compromised neighbour can affect everyone. This is a large part of why we run customer sites on managed WordPress hosting on Google Cloud infrastructure.

2. Run SSL everywhere. SSL encrypts traffic between your visitors and your site, and browsers actively warn people away from sites without it. Certificates are free through Let's Encrypt and included with every reputable host. There is no reason to run without one in 2026. One caution: the padlock means traffic is encrypted, not that the site is safe. Scam sites use SSL too.

3. Put a web application firewall in front of the site. A WAF inspects every request before it reaches WordPress and blocks known attack patterns: SQL injection attempts, exploit probes, malicious bots. Cloudflare's free tier does this well, which is why we deploy it across customer sites. When a new plugin vulnerability is disclosed, a good WAF often blocks the exploit before you have even updated the plugin.

4. Run automated off-site backups on the 3-2-1 rule. Three copies of your data, on two types of storage, one of them off-site. Never keep your only backup on the same server as the site: if the server is compromised, both go together. Daily automated backups with 30 days of history is the standard we run. And test a restore at least quarterly, because an untested backup is a hope, not a plan.

Layer 2: Lock down access

5. Strong unique passwords plus two-factor authentication. Most compromises are logins, not break-ins. Use a password manager (1Password or Bitwarden) to generate a unique 16+ character password for every account, then add 2FA on every administrator login. This one change blocks the vast majority of automated account takeover attempts.

6. Limit login attempts and move the login page. Out of the box, WordPress allows unlimited login guesses at a login URL every bot on the internet knows. Lock out repeat failures after a handful of attempts, add a CAPTCHA, and rename the login URL. None of this stops a determined human, but it takes you off the automated target lists where nearly all attacks originate.

7. Give every user the minimum role they need. Your content writer does not need to install plugins. Your bookkeeper does not need to edit themes. Default new users to Editor or below, keep Administrator accounts to the absolute minimum, and remove access the day someone leaves the business. Stale accounts belonging to former staff and old agencies are one of the most common weaknesses we find when we take over a site.

8. Kill the "admin" username and audit your user list. If your administrator account is literally named "admin", attackers already have half your login. Create a fresh administrator with a unique name, reassign content, delete the original. While you are in there, review every account: if you do not recognise a user, find out why it exists.

Layer 3: Updates and hygiene

9. Update core, plugins, themes and PHP on a schedule. Outdated software is the single largest cause of WordPress compromises. Turn on auto-updates for minor core releases, review plugin updates at least weekly, and keep PHP on a currently supported version. This is the least glamorous practice in the guide and the most important. It is also the bulk of what a maintenance service actually does: our support system holds more than 3,900 automated plugin update records and nearly 1,900 core update confirmations across customer sites, because that volume of patching is what staying secure requires.

10. Delete what you are not using. Every inactive plugin and theme is still code sitting on your server that an attacker can exploit and that nobody is watching. Deactivated is not deleted. If you are not using it, remove it. Fewer plugins means fewer vulnerabilities, faster updates and a faster site.

11. Install only from trusted sources. Stick to the official WordPress repository and established commercial vendors with active support. Nulled "premium" themes and plugins from sketchy download sites are routinely bundled with malware. Installing one hands an attacker the keys and skips every other defence on this list.

12. Close the built-in back doors. Two settings ship enabled that most business sites should turn off. Dashboard file editing lets any administrator account edit PHP directly, which means one stolen admin login becomes full code access; one line in wp-config.php disables it (define('DISALLOW_FILE_EDIT', true);). XML-RPC is a legacy remote-access feature that lets bots test thousands of passwords in a single request; unless you use the WordPress mobile app or Jetpack, have your developer or host disable it.

Layer 4: Monitor and recover

13. Scan daily and log everything. A security plugin such as Wordfence or Sucuri gives you three things worth having: daily malware scans, file integrity monitoring that alerts you the moment a core file changes unexpectedly, and login security. Pair it with an activity log so you can see who changed what and when. When something looks wrong, that log is your forensic trail. Run one security plugin, configured properly. Two will fight each other.

14. Monitor uptime and test your recovery. You want to know your site is down before your customers tell you. Uptime monitoring is free or nearly free. And schedule an actual restore test quarterly: spin up the backup on a staging environment and confirm it works. The moment you need a backup is the wrong moment to discover it does not restore.

Is that security email real? How to triage vulnerability notices

Here is a problem no security checklist covers: business owners regularly receive alarming emails claiming their website has a critical vulnerability or has already been hacked. Customers forward these to our support desk every month, and a large share of them are scams or scare marketing designed to sell you something or steal credentials.

A real one from a customer's inbox: an email titled "Critical vulnerability found: your website is at risk!" that had the owner genuinely worried. Our team's verdict after checking the site took one line: it is a scam, please disregard.

How to tell the difference:

The rule: never click links or act directly from an unexpected security email. Forward it to whoever manages your website and ask them to verify against the site itself. A professional check takes minutes and settles it with evidence rather than fear.

Also worth knowing: corporate IT teams and security scanners sometimes flag WordPress sites for vulnerabilities that a firewall already blocks or a patched version already fixed. When a customer forwards us a scanner report, our team verifies the WordPress version is patched, confirms the firewall rules cover the disclosed exploit, and replies with exactly what was checked. Ask for the same from whoever supports your site.

Hacked email vs hacked website: they are not the same thing

This confusion comes up constantly. A customer or someone they know receives a suspicious email that appears to come from the business, and the immediate fear is "our website has been hacked". Almost always, the website has nothing to do with it.

Three different problems get mixed together:

• Email spoofing. Scammers forge your address in the "from" field without any access to your systems. Fixed at the domain level with SPF, DKIM and DMARC records, which tell receiving mail servers which senders are legitimate for your domain.
• A compromised email account. Someone actually has your mailbox password, usually from a phishing link or a reused password. Fixed by changing the password, enabling 2FA on the mailbox, and reviewing forwarding rules attackers love to plant.
• A compromised website. A different system entirely, with the signs and recovery steps covered in the next section.

Why it matters: the fixes live in different places. Panicking about your website while an attacker sits in your inbox, or wiping your mailbox while spam links sit on your site, solves the wrong problem. If you are unsure which you are dealing with, describe exactly what happened to your support team before anyone starts changing things.

What to do if your WordPress site is hacked

First, confirm it is actually the website. Real signs: browser or Google warnings on your own URL, admin accounts you do not recognise, strange links or pages appearing on the site, a sudden traffic drop, or your host notifying you of malware. If any of those are present, work the list in order:

1. Take the site into maintenance mode so the compromise cannot spread to your visitors while you work.
2. Change every connected password: WordPress admins, hosting, FTP, database, and any email accounts on the domain. Assume the attacker has all of them.
3. Scan for malware and backdoors. A full scan maps the scope of the infection. Attackers routinely plant a second way in, so cleaning only the obvious problem invites a repeat.
4. Restore from a clean backup taken before the compromise. This is the fastest reliable path back, and why backup history matters.
5. Update everything before going live: core, every plugin, every theme, PHP. Outdated software is probably how they got in; do not bring the same hole back online.
6. Audit users and activity logs. Delete unrecognised accounts and trace what the attacker touched while inside.
7. Request a Google review if you were flagged. Once clean, submit a reconsideration request in Search Console, or the "deceptive site" warning stays up after the problem is fixed.

If that list feels beyond what you can handle mid-crisis, that is normal. Get professional help early: recovery done half-way is how sites get re-hacked within the month.

The WordPress security checklist

The whole guide in one list. Print it, work through it, or hand it to whoever manages your site and ask them to confirm each line.

What this looks like with a Care Plan

Everything in this guide is doable yourself. The honest question is whether it will keep getting done next month, and the month after, while you run a business.

This is the work our Website Care Plans exist to absorb. In practice that means managed hosting with the firewall and SSL handled, updates applied and verified continuously, daily off-site backups, malware and uptime monitoring, and a support desk that checks the scary email so you do not have to. When a customer forwards a vulnerability notice, they get back a plain-language answer with evidence: what was checked, what was found, and whether anything needs doing.

Security is not a project you finish. It is a routine someone has to own. Whether that is you with this checklist or us with a Care Plan, make sure it is genuinely owned.

Frequently Asked Questions