# WordPress Security: A Hardening Checklist for Site Owners

- Canonical page: https://bestwebhosting.website/wordpress-security-hardening-checklist/
- Language: en
- Arabic version: [أمان WordPress: قائمة تحصين عملية لأصحاب المواقع](https://bestwebhosting.website/ar/wordpress-security-hardening-checklist.md)
- Published: 2026-11-08T07:00:00+00:00 — Updated: 2026-11-08T07:00:00+00:00
- Author: BWH Newsroom — Best Web Hosting
- Section: [Cybersecurity](https://bestwebhosting.website/category/cybersecurity.md)

> A practical WordPress security checklist: updates, logins, plugins, file permissions, backups, a firewall and monitoring, in order of impact.

Most hacked WordPress sites are not victims of clever, targeted attacks. They are found by automated scanners looking for outdated plugins, weak passwords and exposed files across millions of sites. That is good news: a handful of disciplined habits blocks the large majority of these attacks. This checklist is ordered by impact.

- Outdated plugins and themes are the most common way in, so updates come first.
- Strong unique passwords plus two-factor authentication protect logins.
- Backups stored off the server are your last line of defence.

## 1. Keep everything updated

- Enable automatic updates for WordPress core minor and security releases; consider them for major releases too.
- Update plugins and themes promptly, especially when the changelog mentions security fixes.
- Use a supported PHP version; old versions no longer receive security patches.
- Test major updates on a staging copy for important sites.

## 2. Remove what you do not use

Deactivated plugins and unused themes can still contain vulnerable code that attackers reach directly. Delete them. Keep one default theme as a fallback. Avoid plugins that are no longer maintained, and never install "nulled" (pirated) premium plugins or themes, which often contain backdoors.

## 3. Protect logins

- Use unique, long passwords stored in a password manager.
- Turn on two-factor authentication for every account with editor or administrator rights.
- Limit login attempts or use your host's or firewall's brute-force protection.
- Give each person their own account with the lowest role they need. Remove accounts when people leave.
- Do not use "admin" as a username.

## 4. Secure the hosting account

- Enable two-factor authentication on your hosting panel, registrar and email account; whoever controls these controls your site.
- Use SFTP or SSH instead of plain FTP.
- Choose hosting that isolates accounts from each other and offers malware scanning.

## 5. Harden WordPress settings

- Disable the built-in file editor by adding define('DISALLOW_FILE_EDIT', true); to wp-config.php, so a stolen admin login cannot edit PHP files from the dashboard.
- Use correct file permissions: typically 644 for files and 755 for folders, with wp-config.php more restricted where your host allows.
- Prevent PHP execution in the uploads folder through server rules.
- Turn off XML-RPC if you do not need it (some apps and plugins do use it).
- Make sure directory listing is disabled on the server.

## 6. Use HTTPS everywhere

Force HTTPS for the whole site and the admin area so passwords and cookies are never sent unencrypted.

## 7. Add a web application firewall

A WAF blocks known attack patterns before they reach WordPress. It can run at the network edge (CDN or host) or as a plugin. Edge firewalls also absorb malicious traffic before it uses your server's resources.

## 8. Back up and know how to restore

Keep daily backups stored away from the server, with several versions. If a site is infected, you may need a copy from before the infection began. Our [website backup guide](/how-to-back-up-website/) explains the 3-2-1 rule.

## 9. Monitor

- Use uptime monitoring to know quickly when something breaks.
- Run periodic malware scans and check for unexpected new admin users.
- Watch Google Search Console for security warnings.
- Enable activity logging on sites with several editors.

## 10. Have a plan for when things go wrong

Know who to call, where backups are and how to put the site into maintenance mode. If you are hacked, change all passwords, restore a clean backup, update everything and find how the attacker got in, or the problem will return.

## Frequently asked questions

### Is WordPress insecure?

The WordPress core is actively maintained and reviewed. Most problems come from outdated or poorly written plugins and themes, weak passwords and unmaintained hosting.

### Do I need a security plugin?

It helps if your host does not provide a firewall, malware scanning and login protection. Do not stack several security plugins; they can conflict and slow the site.

### Should I hide the login page?

Changing the login URL reduces automated noise but is not a substitute for strong passwords and two-factor authentication.

Topics: Website security, WordPress