WordPress remains the most used CMS in the world. That popularity has many advantages, but also an obvious drawback: it is one of the main targets of automated attacks.

The good news is that most security incidents do not occur because WordPress is insecure, but because there are poor configurations, vulnerable plugins, weak credentials, or unmaintained servers.

This is where WordPress hardening comes into play, a set of measures aimed at reducing the attack surface and making any intrusion attempt as difficult as possible.

In this guide, you will find a practical WordPress hardening checklist adapted to the WordPress security reality of 2026, with recommendations covering both the CMS itself and the server, hosting, and user management. It’s not just about installing a security plugin, but about applying a layered strategy that constantly reduces risks.

What does hardening WordPress mean?

Hardening involves strengthening a system’s configuration to make it more resistant to attacks. In WordPress, it means applying a series of measures aimed at reducing the chances of an attacker finding a way in.

There is no website impossible to compromise. Absolute security simply does not exist. The goal of hardening is not to eliminate all risks, but to make exploiting them much more difficult and costly.

In a WordPress site, this process combines aspects such as:

• CMS configuration
• Continuous maintenance
• Access control
• Server protection
• Backups
• Monitoring
• Good administration practices

In other words, securing WordPress does not depend on a single action, but on many small decisions that, together, build a much stronger defense.

In 2026, this approach becomes even more important. Automated attacks use artificial intelligence to locate vulnerable installations, detect outdated versions, or exploit known flaws in a matter of minutes. The best defense is to minimize the exposed surface as much as possible before someone tries to exploit it.

Why does WordPress still need hardening in 2026?

Because the problem is rarely WordPress itself.

The CMS core receives constant updates and has a huge community reviewing vulnerabilities. However, a complete website is made up of many more components, and any of them can become an entry point.

The most common risks remain:

• Abandoned plugins
• Outdated themes
• Weak passwords
• Users with excessive permissions
• Brute force attacks
• Malware introduced through known vulnerabilities
• Insecure server configurations

Additionally, in recent years, the automation of attacks has increased considerably. Today we are not only talking about bots trying millions of passwords, but also tools capable of identifying specific versions of vulnerable plugins, detecting insecure configurations, or analyzing supply chains to find compromised components.

Therefore, WordPress web security can no longer be understood as a one-time review. It is a continuous process.

A very common example is a company that develops a website for a client, publishes it, and does not review the project for months. When a critical vulnerability appears in one of its plugins, bots can locate thousands of vulnerable installations in a few hours. If that site is not kept updated, it ends up becoming an easy target.

Applying a strategy to harden WordPress security means precisely avoiding this type of situation through periodic reviews and preventive measures.

Hardening checklist for WordPress in 2026

Below you will find a practical checklist with the main measures you should review to properly protect WordPress.

Not all have the same priority, but together they form a much more effective WordPress security best practices strategy than relying solely on a plugin.

Keep WordPress, themes, and plugins always updated

If there were one measure to choose to improve the security of a WordPress site, it would probably be this one.

The vast majority of vulnerabilities exploited each year affect old versions of plugins, themes, or the WordPress core itself. When a security update is released, the technical details of the flaw are usually made public shortly after, making it easier for attackers to automate its exploitation.

Therefore, it is essential to:

• Update the WordPress core as soon as possible.
• Keep all plugins at their latest stable version.
• Also review installed themes, even if they are not active.
• Check compatibility before major updates.

A very common mistake is to think that a deactivated plugin no longer poses any risk. In reality, if it remains installed on the server, an attacker can still exploit certain vulnerabilities.

Therefore, it is advisable to remove any component that is no longer useful.

Remove plugins and themes you don’t use

Each plugin adds new functionalities… but also new code.

And the larger the installed code, the greater the attack surface will be.

Keeping components you no longer use means taking unnecessary risks:

• They may stop receiving support.
• They may contain vulnerabilities discovered years later.
• They may conflict with new versions of WordPress.
• They increase maintenance complexity.

The recommendation is to keep only what truly adds value to the project.

If you ever need to use a plugin again, you can always install its latest version from an official source.

Use only trusted plugins and themes

Not all plugins offer the same level of quality.

Before installing one, it is advisable to review aspects such as:

• Update frequency.
• Developer reputation.
• Number of active installations.
• Compatibility with the current version of WordPress.
• Available support.

It is especially important to avoid so-called nulled plugins or pirated versions of premium themes and extensions.

Although they may appear to work the same, it is relatively common for them to incorporate backdoors, malware, or code designed to take control of the site.

When we talk about how to secure a WordPress site, using only components from the official repository or recognized developers remains one of the most cost-effective decisions from a security standpoint.

Protect access to wp-admin and wp-login.php

The admin panel is one of the attackers’ favorite targets. It’s no coincidence: if they manage to access an account with sufficient privileges, they can take full control of the site.

Therefore, an important part of WordPress security measures is to make access to the admin area as difficult as possible.

There are several ways to do this:

• Limit the number of login attempts.
• Temporarily block IP addresses after several failed attempts.
• Change the access URL when it makes sense to do so.
• Restrict access by IP in internal or corporate projects.
• Add an additional layer of authentication at the server level.

This last measure is especially interesting for admin panels used by only one or two people. Even if someone discovers your credentials, they would still have to overcome that second barrier.

However, it is worth remembering that some overly aggressive restrictions can affect certain functionalities or collaborators working from different locations, so it is always advisable to test any changes before applying them in production.

Enable two-factor authentication (2FA)

A strong password is no longer enough.

Credential leaks are becoming more frequent, and many passwords end up circulating in public databases without the owner even knowing.

Two-factor authentication adds an additional check that greatly complicates unauthorized access.

Even if an attacker manages to find out the password, they will still need a second element to log in, usually a temporary code generated in an authentication app or a physical security key.

In any WordPress project, 2FA should be mandatory for administrators and highly recommended for editors or users with elevated permissions.

It is one of the measures with the best effort-to-benefit ratio.

Use strong passwords and secure access policies

Many intrusions still start with a password that is too simple or reused across multiple services.

A secure password should be:

• Unique for each service.
• Long enough.
• Hard to guess.
• Generated using a password manager whenever possible.

Avoid using proper names, birth dates, the company name, or any data that can be easily found on social media.

Additionally, it is advisable to periodically review who has access to the site.

In projects that have been active for several years, it is common to find former employees, external collaborators, or agencies that retain users with elevated permissions even though they no longer need them.

Applying the principle of least privilege means that each user should only have the permissions necessary to perform their job.

Review user roles and permissions

Not all users need to be administrators.

WordPress includes different roles precisely to limit the actions each person can perform.

Before granting elevated privileges, it is worth asking if they are really necessary.

For example:

• A writer can publish content without managing plugins.
• An editor can review posts without modifying the site settings.
• A developer may need temporary access during a migration, but not indefinitely.

Periodically reviewing registered users allows you to detect old accounts, forgotten accesses, or excessive privileges that unnecessarily increase risk.

In security audits, it is surprisingly common to find installations with several administrators created years ago, and no one remembers what they were for.

Enforce HTTPS throughout the site

Nowadays, it is not enough to protect only the main page.

All traffic should be encrypted via HTTPS, including:

• The admin panel.
• The login form.
• The public area.
• The APIs.
• Any exchange of confidential information.

In addition to improving security, HTTPS protects session cookies, prevents traffic manipulation during transmission, and conveys greater trust to both users and search engines.

Fortunately, most providers include free SSL certificates that can be activated in just a few minutes.

However, installing the certificate is not enough. It is also advisable to check that there are no resources loaded via HTTP (mixed content), as they could weaken the site’s protection.

Correctly configure file and folder permissions

Incorrect permission settings can facilitate unauthorized modifications or even the execution of malicious code.

In most WordPress installations, the recommended permissions are usually:

• 755 for directories.
• 644 for files.

These values allow WordPress to function correctly without granting more privileges than necessary.

Special attention should be paid to any folder that allows writing, as it could be used to upload malicious files if there is a vulnerability.

It is also advisable to check that the files belong to the appropriate user and avoid overly permissive permissions like 777, which should seldomly be used in a production environment.

Protect critical WordPress files

Not all files have the same importance.

Some contain especially sensitive information or allow modifying the entire site’s behavior.

The main ones are:

• wp-config.php
• .htaccess
• xmlrpc.php (if not used)
• old installation files
• directories with public file listing

A good practice is to prevent direct access to these files from the browser when possible and to remove any temporary files, backups, or test scripts that have been left behind after development.

A .zip file with a copy of the website accidentally left on the server can be much more dangerous than a vulnerability in WordPress itself.

Disable unnecessary functions

Reducing functionalities also means reducing risks.

For example, many administrators are unaware that WordPress allows direct editing of PHP files from the admin panel itself.

If an attacker gains access with sufficient privileges, that functionality makes it easy to introduce malicious code in seconds.

Therefore, it is usually recommended to disable file editing from the panel using the corresponding constant in wp-config.php.

Similarly, it is worth reviewing other elements that you may never use:

• XML-RPC, if no application depends on it.
• Unused services or endpoints.
• Script execution in directories intended solely for storing files.
• Legacy modules that no longer provide any functionality.

The smaller the exposed surface, the fewer opportunities an attacker will have to find an entry point.

Change the table prefix if it’s a new installation

For many years, all WordPress installations used the wp_ prefix for database tables.

Currently, it is still possible to change it during installation, and doing so adds a small additional layer of protection against certain automated attacks that assume the default prefix.

It is important to clarify that this is not a magic solution.

By itself, it will not prevent an intrusion, but it can make some automated attacks more difficult and is part of the layered defense approach characteristic of WordPress web hardening.

However, modifying the prefix in an existing installation is usually a delicate process that must be carefully planned to avoid compatibility issues.

Implement automatic and verified backups

Backups are the last line of defense when everything else fails.

A critical vulnerability, an error during an update, a ransomware attack, or even human error can leave a site completely unusable. At that moment, having a recent backup can make the difference between recovering the website in a few minutes or losing days of work.

However, making backups is not enough. You also have to ensure they actually work.

A backup strategy should meet at least these requirements:

• Perform automatic backups with the appropriate frequency.
• Store backups in a location other than the server itself.
• Keep several historical versions.
• Periodically test restoration.

The frequency will depend on the type of project. A blog that publishes one article a month does not need the same level of protection as an e-commerce site with orders every few minutes.

If you have never tried to restore a backup, you cannot assume it will work when you really need it.

Use a firewall and protection against bots or brute force attacks

A large part of the traffic any WordPress site receives does not come from people, but from bots.

Many are completely legitimate, like search engine crawlers, but others try to locate vulnerabilities, access the admin panel, or exploit known flaws.

This is where a Web Application Firewall (WAF) comes into play.

A web firewall analyzes requests before they reach WordPress and can automatically block them:

• Brute force attacks.
• Attempts to exploit known vulnerabilities.
• Malicious traffic.
• Automated bots.
• Suspicious requests.

Depending on the provider, this protection can be implemented via a plugin, at the server level, or even before the traffic reaches the hosting.

Solutions integrated into the infrastructure often offer a significant advantage: they stop the attack before it consumes WordPress resources.

Scan for malware and monitor file integrity

Not all attacks cause an immediate website crash.

Often, the goal is to introduce malicious code that remains hidden for weeks or months.

That code can be used to:

• Send spam.
• Redirect visitors.
• Distribute malware.
• Create hidden users.
• Use the server for other attacks.

For this reason, it is advisable to perform periodic scans that detect unexpected changes in the site’s files.

Many tools automatically compare WordPress core files with official versions and alert when they find suspicious modifications.

Early detection is often one of the factors that most reduce the impact of a security incident.

Review logs and suspicious activity

Server logs tell the story of everything that happens on a website.

Analyzing them periodically allows you to detect abnormal behaviors long before they become a serious problem.

Some indicators worth monitoring are:

• Multiple failed login attempts.
• Unexpected creation of new users.
• Changes to important files.
• Upload of unknown files.
• Repeated errors.
• Unusual traffic spikes.
• Massive requests to the same resource.

For example, receiving thousands of requests directed to wp-login.php in a few minutes usually indicates an automated brute force attack.

Similarly, detecting that an admin user has logged in from a country where they never work may justify an immediate review.

Continuous monitoring allows you to react before the incident has significant consequences.

Separate development and production environments

Testing directly on a live website is never a good idea.

In addition to the risk of causing visible errors for visitors, insecure configurations can also be introduced that end up reaching the production environment.

The recommendation is to always work with a staging environment, where you can test:

• Important updates.
• New plugins.
• Design changes.
• Server modifications.

That environment should remain protected by authentication and, above all, prevent indexing by search engines.

It wouldn’t be the first time a test copy appears on Google with publicly accessible confidential information.

Keep PHP and the server updated

When talking about WordPress server security, many people focus solely on the CMS and forget that all the surrounding software also needs maintenance.

Updating only WordPress while your website continues to work with outdated versions of PHP leaves a significant part of the attack surface open.

Keeping the technical stack updated provides several advantages:

• Fixes known vulnerabilities.
• Improves performance.
• Increases compatibility with new versions of WordPress.
• Allows the use of more modern security features.

This review should also include the database, system libraries, and any other component that is part of the execution environment.

Choosing a modern version of PHP not only helps protect your WordPress but also improves loading times and ensures compatibility with the latest versions of the CMS.

Strengthen hosting security

A well-configured WordPress can still be vulnerable if the environment where it is hosted does not offer minimum guarantees.

Therefore, WordPress hosting security should also be part of any hardening strategy.

When choosing a provider, it is worth considering aspects such as:

• Two-factor authentication to access the client panel.
• Access via encrypted SSH or SFTP.
• Easy-to-manage SSL certificates.
• Automatic backups.
• Resource monitoring.
• Isolation between accounts.
• Periodic infrastructure updates.

In short, security does not end when WordPress is properly configured. It also depends on the environment that keeps it running every day.

Server-level hardening measures that make a difference

So far, we have seen actions that mainly depend on the site administrator.

However, many of the most effective protection layers are found one level below: the server itself where WordPress runs.

Therefore, when we talk about hardening, we must also pay attention to the environment where the application runs. A properly configured server can stop automated attacks, limit the impact of a vulnerability, and prevent an incident from affecting other sites hosted on the same infrastructure.

WAF and application rules

A Web Application Firewall (WAF) analyzes each HTTP request before it reaches WordPress.

Its goal is to identify known attack patterns and block them automatically. Among other threats, it can detect:

• Brute force attempts against the admin panel.
• SQL injection attacks.
• Cross-Site Scripting (XSS).
• Attempts to upload malicious files.
• Exploitation of known vulnerabilities in plugins and themes.

Unlike a security plugin, a server-implemented WAF can stop these requests before they consume WordPress resources, reducing both the risk of intrusion and server load.

A widely used solution is ModSecurity, which allows applying protection rules adapted to applications like WordPress and updating those rules as new threats appear.

Protection against brute force attacks

Not all attacks seek to exploit a vulnerability. Many simply try to guess credentials through thousands of login attempts.

Tools like Fail2Ban help mitigate this problem by monitoring server logs and automatically blocking IP addresses that exhibit suspicious behavior.

For example, if the same IP tries to log in hundreds of times in a few minutes, it can be temporarily blocked even before WordPress processes the requests.

This type of protection reduces resource consumption and significantly complicates automated attacks.

Account and resource isolation

One of the least visible but most important aspects of modern hosting is account isolation.

In a poorly configured shared server, a vulnerability in one website could affect the rest of the sites hosted on the same machine.

In addition to the security component, this isolation also improves server stability, preventing a site with excessive CPU or memory consumption from affecting the performance of others.

Protection against malware and malicious execution

Current attacks do not always seek to take a website offline. Often, the goal is to install malicious code that remains hidden for as long as possible.

Therefore, it is crucial to combine different layers of protection on the server.

Among the most common measures are:

• Automatic malware scans.
• Monitoring changes to critical files.
• Execution restrictions in directories intended solely for storing content.
• Automatic quarantine of suspicious files.
• Alerts when unexpected modifications are detected.

These measures allow detecting problems even when the attacker has managed to access the site, reducing response time and facilitating recovery.

Continuous update of the technical stack

Hardening also involves keeping everything that makes the website work up to date.

We are not just talking about WordPress.

We must also keep up to date:

• PHP
• The web server (Apache, Nginx, or LiteSpeed)
• The database
• OpenSSL
• System libraries
• Installed modules

A vulnerability in any of these components can compromise the site, even if WordPress is fully updated.

If you use a hosting provider that keeps its infrastructure updated, this task becomes much easier. At cdmon, for example, we provide you with the latest stable versions of PHP and MariaDB so you can keep your site up to date and benefit from both security and performance improvements.

Server security is also part of hardening

A properly configured WordPress installation still needs a secure environment to offer the highest level of protection.

Therefore, hardening should be understood as a layered strategy involving the CMS, the server, the operating system, the network, and the hosting itself. The more independent layers work together, the lower the probability that a single failure will compromise the entire project.

Common mistakes when hardening WordPress

Applying security measures is important, but doing it incorrectly can also cause problems.

These are some of the most common mistakes we find in security audits:

Thinking that a single plugin solves everything

Security plugins are very useful tools, but they do not replace a complete protection strategy.

Security depends on multiple factors: the server, updates, user management, permissions, backups, and monitoring.

Leaving inactive themes and plugins installed

Even if they are deactivated, they are still code present on the server.

If they contain a known vulnerability, they can still become an entry point.

Granting admin permissions to too many users

It is common to give admin permissions «just in case».

The recommendation is just the opposite: always apply the principle of least privilege and grant only the permissions necessary for each user.

Never reviewing the logs

Many intrusions could be detected much earlier if server logs were periodically reviewed.

Waiting for the website to stop working usually means the problem has been present for some time.

Neglecting hosting

It is not much use having WordPress perfectly configured if the environment where it runs does not receive maintenance or uses outdated software versions.

Applying changes directly in production

Updating important plugins, modifying configurations, or installing new functionalities without testing them first can cause unexpected errors or leave the site inaccessible.

Whenever possible, use a staging environment.

Leaving a test environment accessible

A publicly exposed development copy may contain users, configurations, or confidential information.

Additionally, if it is outdated, it can become a way to access the rest of the infrastructure.

What tasks should you review weekly, monthly, and quarterly

The best way to maintain security is to make it a routine.

Not all tasks require the same frequency.

Weekly tasks

Every week it is advisable to check:

• Site availability.
• Pending WordPress updates.
• Plugin and theme updates.
• Backup functionality.
• Suspicious access attempts.
• Abnormal resource consumption.

These checks take just a few minutes and allow you to detect problems before they escalate.

Monthly tasks

Once a month, it is advisable to conduct a more in-depth review.

For example:

• Audit registered users.
• Review installed plugins.
• Remove components that are no longer used.
• Analyze server logs.
• Run a full malware scan.
• Verify the integrity of core files.

Quarterly tasks

Every quarter, it is advisable to review the security strategy as a whole.

Among other actions:

• Validate that backups can be restored correctly.
• Review permissions and roles.
• Check server configurations.
• Evaluate the hosting status.
• Review access policies.
• Update project documentation.

This type of review helps detect small problems that, over time, can become significant risks.

Quick hardening checklist for WordPress in 2026

If you want to quickly check the status of your installation, here is the ultimate WordPress hardening checklist that summarizes the most important measures.

• ✅ WordPress updated.
• ✅ Plugins updated.
• ✅ Themes updated.
• ✅ Unused plugins and themes removed.
• ✅ Two-factor authentication enabled.
• ✅ Strong passwords for all users.
• ✅ HTTPS enforced throughout the site.
• ✅ File permissions reviewed.
• ✅ wp-config.php protected.
• ✅ .htaccess correctly configured.
• ✅ XML-RPC disabled if not used.
• ✅ Firewall active.
• ✅ Protection against brute force.
• ✅ Periodic malware scans.
• ✅ Verified backups.
• ✅ Logs regularly reviewed.
• ✅ PHP updated.
• ✅ Server updated.
• ✅ Staging environment.
• ✅ Periodic user audit.

The more items you can check off, the smaller your site’s attack surface will be.

Comparison of measures by their impact

Conclusion: hardening is not a one-time task, but a habit

WordPress hardening is not about installing a plugin and forgetting about security for months.

It is about building a layered strategy involving the CMS, the server, the hosting, the users, and the maintenance processes.

Most successful attacks exploit relatively simple errors: outdated versions, weak passwords, excessive permissions, or abandoned components.

The good news is that all of them can be prevented by applying a routine of periodic review.

Following a checklist like the one we have seen will help you protect WordPress much more effectively, reduce the attack surface, and react sooner to any incident.

And remember: good hosting is also part of that strategy. Having automatic backups, updated PHP versions, firewall, SSL certificates, and server monitoring provides an additional layer of protection that complements the work done within WordPress.

Frequently asked questions

What is hardening in WordPress?

Hardening in WordPress is the set of measures that strengthen the site’s security to reduce risks, limit the attack surface, and make unauthorized access or vulnerability exploitation more difficult.

What is the most important measure to protect WordPress?

Keeping WordPress, plugins, and themes always updated is one of the most effective measures, as many security breaches exploit old versions with known vulnerabilities.

Is it enough to install a security plugin in WordPress?

No. A plugin can help, but it does not replace a complete strategy. Security also depends on updates, hosting, passwords, permissions, backups, and server configuration.

Is it advisable to enable two-factor authentication?

Yes. Two-factor authentication adds an extra layer of protection to the admin panel and significantly reduces the risk of unauthorized access.

Which WordPress files should be especially protected?

The most important ones are wp-config.php, .htaccess, access to wp-admin, the wp-login.php page, and xmlrpc.php when not used.

How often should WordPress security be reviewed?

It is advisable to perform small checks every week, more comprehensive reviews every month, and general audits every quarter.

Does hardening also depend on hosting?

Yes. Secure hosting helps protect the site through firewall, account isolation, backups, SSL certificates, updated PHP versions, and infrastructure monitoring.

What are the most common security errors in WordPress?

The most common are using weak passwords, not updating plugins, keeping inactive themes installed, granting too many permissions to users, and never reviewing logs or backups.