WordPress security in 2026 isn’t about genius attackers — nobody hacks a WordPress site by hand anymore. The attacks are automated: bots that scan thousands of sites an hour, looking for outdated plugins, reused passwords, and hosts that still think security is the customer’s problem. The economics are simple — an attacker only needs one open door, and the cheapest doors are always the unattended ones.
The other thing worth saying up front: there’s an old triangle in this industry — fast, good, cheap: pick two. We build and host at the quality-and-performance end and skip the cheap corner entirely, because in our experience cheap is where security incidents come from. Most of the cleanup jobs we’ve taken on started life as a $4-a-month hosting plan. (We’ve written more about why cheap hosting is slow by design — the same economics explain the security side.) This checklist is the same one we run on every site we look after — it takes about twenty minutes on a normal site, and it closes the doors most attackers actually walk through.
1. Start at the hosting layer — it matters more than any plugin
The single biggest security decision you make for a WordPress site is where you host it. Not which security plugin you install — where it lives. A decent host gives you:
- A web application firewall (WAF) that blocks the common exploit patterns — SQL injection, cross-site scripting, known plugin exploits — at the edge, before they ever reach WordPress. A good WAF quietly absorbs the overwhelming majority of automated attack traffic. Your security plugin cleans up afterwards; a WAF stops it at the gate.
- Isolation. Your site should run in its own space (a container or dedicated PHP-FPM pool) so that a compromised site two directories over doesn’t become your problem. On cheap shared hosting, isolation is often exactly what got sacrificed for the price.
- Server-side patching. TLS certificates, PHP versions, and the web server itself are the host’s job. If your host is still offering PHP 7.4 in 2026, that tells you everything about their patching culture.
Here’s the responsibility split that surprises people: your host owns the platform, you own WordPress itself — core, plugins, themes, users and passwords. Both halves have to be right. This is a big part of why we built DomainCastle®, our managed WordPress hosting: WAF and DDoS protection, daily backups, and updates handled by people who actually read the changelogs, not a script that auto-updates everything at 2am and crosses its fingers.
2. The update habit (the boring one that prevents most breaches)
The overwhelming majority of compromised WordPress sites were running something with a known, already-patched vulnerability. Not a zero-day — a bug with a fix available that nobody clicked. So:
- WordPress core: turn on automatic updates for minor versions. For major versions, update on a staging copy first, then push — five minutes of caution beats a broken checkout.
- Plugins and themes: check weekly. Update weekly. And delete what you’re not using — an inactive plugin still has its files on disk, and those files are still reachable. “Inactive” is not a security control.
- Never install nulled plugins or themes. “Free premium” downloads are the single most common way small-business sites get owned. We’ve opened up nulled downloads and found phone-home code, hidden admin accounts, and backdoors into the mail system. If you can’t afford the licence, you definitely can’t afford the cleanup.
- Vet before you install: when was it last updated? Does it have a support footprint? A plugin abandoned eighteen months ago is a liability wearing a feature list.
3. Admin hardening — twenty minutes, once
- No user called “admin”. Bots hammer that username first, always. Give every human a unique username, and give each the least role they can work with — most content writers need Author, not Administrator.
- Two-factor authentication on every admin account. An authenticator app, not SMS. Yes, every account — attackers look for the one you set up in a hurry.
- Limit login attempts so password guessing gets throttled, and turn off XML-RPC if nothing on your site uses it (most sites nothing does — but Jetpack and some mobile apps do, so check first).
- Strong, unique passwords. A password manager makes this a solved problem. Reused passwords are how one unrelated breach becomes your problem.
- Disable the built-in file editor — one line in wp-config:
define( 'DISALLOW_FILE_EDIT', true );. If an attacker gets an admin session, this stops them editing your theme files directly in the dashboard. - File permissions: directories 755, files 644, and wp-config.php tighter if your host supports it. Ask your host — they should have a view.
4. Backups you have actually tested
A backup you’ve never restored is a hope, not a backup. The standard worth aiming for: daily, automatic, off-site (not on the same server — a compromised server usually means compromised backups too), with a few weeks of history so ransomware or a slow-burning hack can’t take yesterday’s copy with it. Keep copies of the database and the files, including your wp-content uploads.
Then, once — just once — do a test restore to a staging site. It takes an hour and it’s the only way to know the backups are real. If your host can’t tell you where backups are stored, how long they’re kept, and how you’d restore one, you’ve learned something important about your host.
5. Know when something’s wrong
Uptime monitoring (even a free five-minute checker) tells you the site’s down; file-change monitoring tells you someone’s edited something they shouldn’t have. Both are cheap. Both give you the thing that matters most in an incident: knowing early. Most horror stories are sites that were compromised for months before anyone noticed.
What this doesn’t cover
Honesty section: a checklist doesn’t make you unhackable — nothing does. What it does is move you out of the “cheap target” bucket, which is where almost all the actual attacks happen. If you want the boring plumbing handled properly — hosting, WAF, updates, tested backups, someone to call when it goes sideways — that’s literally our job: DomainCastle® managed WordPress hosting. And if something already looks wrong, use the site rescue option on our contact page and we’ll jump on it.
Fast, good, cheap — pick two. We don’t do cheap. But we do answer, and the twenty minutes above will cover most of it even if you never pay us a cent.
