WordPress runs more than 40% of all websites on the internet, which makes it the most popular content management system in the world and, for the same reason, the most attacked. The WordPress core itself is maintained to a high standard, but the ecosystem around it, themes, plugins, logins and hosting, is where most compromises happen. This guide sets out the essential steps you should take to protect a WordPress website in 2026, in the order that matters most.
The threat picture has shifted in recent years. Patchstack’s State of WordPress Security in 2026 report recorded 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42% increase on the previous year, with 91% of those found in plugins. Only six were reported in the WordPress core, and all were low risk. The practical implication is clear: most of your security effort belongs on the code you add to WordPress, not on WordPress itself.
Why WordPress Security Matters in 2026
Scale is the reason WordPress attracts so much attention from attackers. Because WordPress powers an estimated 41.5% of all websites according to W3Techs, a single exploit in a popular plugin can be recycled across millions of sites. Automated bots scan the web continuously for known vulnerabilities, out-of-date versions and weak login pages.
A site does not need to be a high-value target to be attacked; it just needs to be reachable.
The consequences of a compromise go beyond a defaced homepage. Attackers commonly install backdoors that let them return at will, inject malicious redirects for SEO spam, or load cryptocurrency miners onto your server. If a site handles customer data, a breach can bring legal obligations under UK data protection law and a serious reputational hit. For a business site, the cost of cleaning up an infection usually far exceeds the cost of preventing one.
The Main Threats Facing WordPress Sites
Understanding what you are defending against makes the rest of this guide easier to apply. Four attack routes account for the overwhelming majority of WordPress compromises.
Plugins are the number one entry point. Patchstack’s 2026 report found that 91% of new weak points were WordPress plugin vulnerabilities and 9% in themes in 2025, with highly exploitable vulnerabilities up 113% year on year. When a developer stops maintaining a plugin, its known flaws never get fixed. Attackers catalogue these dead plugins and probe for them automatically.
The standard WordPress login at /wp-login.php is probed constantly. Bots try common usernames such as admin and large password lists until something works. The attack is noisy but effective on sites with weak credentials, no rate limiting and no two-factor authentication.
Many breaches start with a single stolen or guessed password. Reused passwords from other breaches are a particular problem, because attackers feed previously leaked credentials into WordPress login pages and see which ones still work.
Once an attacker has a foothold, they typically install a backdoor, a small piece of code that lets them bypass normal logins. Backdoors are often hidden inside plugin files or upload directories, and they survive even after you change passwords, which is why cleanup usually means restoring from a clean backup rather than patching the infection.
Essential Steps to Secure Your WordPress Site
The steps below are the current baseline for a secure WordPress installation in 2026. They are ordered roughly by impact. If you do nothing else, do the first three.
1. Keep WordPress, themes and plugins updated
Updates exist because of known vulnerabilities, so a site running old versions is handing attackers a map. Enable automatic updates for WordPress core, and make sure themes and plugins update too. The WordPress hardening guide published by the WordPress project treats updating as the single most important control, because once a vulnerability is fixed, the exploit details are public and old versions become easy targets.
2. Remove unused plugins and themes
Every installed plugin is a potential entry point, whether it is active or not. Deactivate and delete anything you do not use, and delete unused themes in the same pass. A smaller attack surface is a genuinely more secure site, and it is one of the cheapest WordPress hardening measures available.
3. Enforce strong passwords and two-factor authentication
Replace default usernames such as admin, require strong unique passwords, and enable two-factor authentication (2FA) for every account with editorial or administrative access. 2FA stops the vast majority of credential-based attacks, because a stolen password alone is no longer enough to log in. Several reliable 2FA plugins exist for WordPress, and managed platforms increasingly include it as standard.
4. Limit login attempts
Rate limiting the login page blocks brute force attacks by locking an account or IP address after a handful of failed attempts. This is available through most security plugins and through server-level configuration. Combined with 2FA, it makes the login page a very poor target.
5. Take regular, tested backups
A website backup is your safety net when everything else fails. Schedule automated backups of both the files and the database, store copies off-site, and test a restore at least once. An untested website backup is a hope, not a plan, and the moment you need it is the worst time to discover it does not work.
6. Harden wp-config.php and file permissions
The wp-config.php file holds your database credentials and security keys. WordPress’s own hardening guidance recommends protecting it from unauthorised access and disabling file editing through the dashboard by setting DISALLOW_FILE_EDIT to true. Set sensible file permissions, typically directories to 755 and files to 644, so that only your hosting account can write to the installation.
7. Use a security plugin and consider a firewall
A reputable security plugin adds malware scanning, login protection and file integrity monitoring. A web application firewall (WAF) sits in front of the site and filters malicious traffic before it reaches WordPress, which can block attacks even before a patch is available. This is a meaningful layer in 2026, because vulnerability disclosure to public exploit is now measured in days.
8. Choose hosting that takes security seriously
Your hosting provider is part of your security stack. A provider that keeps its platform patched, offers free SSL certificates, isolates customer accounts and provides clean backups changes how much risk reaches your site in the first place. Managed WordPress hosting handles updates, security scanning and backups for you, which removes the most commonly missed steps from your list entirely.
What These Measures Cannot Do
No configuration makes a site unhackable, and you should treat anyone who claims otherwise with suspicion. Security plugins reduce risk; they do not remove it. Zero-day vulnerabilities exist, and a determined attacker with enough time can sometimes find a way through. The goal of the steps above is to make your site a hard target, so that automated attacks move on and the cost of attacking you is not worth the payoff.
These recommendations are version-sensitive. WordPress moves quickly, and the specifics of settings, plugin names and server configuration change over time. What is current in 2026 may be dated in a few years, so treat official documentation as the source of truth for your exact setup.
Frequently Asked Questions
The WordPress core is maintained and patched by a large development community, and core vulnerabilities are comparatively rare. Most compromises happen through third-party plugins and themes, weak passwords, or outdated installations. Keeping core, plugins and themes updated is the single most effective way to stay secure.
As soon as updates are available, particularly for security patches. Once a vulnerability is fixed publicly, the exploit details are known, and unpatched sites become targets within days. If you cannot update immediately, at least ensure automatic updates are enabled where your setup allows it.
WordPress plugin vulnerabilities plugins are the leading cause, accounting for 91% of new vulnerabilities logged in 2025. Brute force attacks on weak logins and reused passwords are the other common route. Removing unused plugins and enforcing strong logins with 2FA addresses both.
Managed hosting typically includes server-level protection, scanning and automatic updates, which covers the fundamentals. A security plugin can add client-side layers such as login rate limiting and file integrity monitoring. Check what your host already provides to avoid overlapping tools that can slow your site down.
Work from a known-good position: restore from the most recent clean backup, change every password including database credentials and hosting logins, and remove any accounts you do not recognise. If the infection is persistent, professional malware cleanup may be needed. Treat website backups as the primary recovery path, not as an optional extra.
Yes. 2FA is one of the cheapest and most effective controls available, and it neutralises the most common attack vector, stolen or guessed passwords. Even a small business site holds data worth protecting, and the setup cost is a few minutes per user.
