How to secure a WordPress site: the 2026 checklist

If your site is already showing spam, redirects or warnings, clean it first with what to do when WordPress is hacked. Hardening a hacked site leaves the attacker’s back door in place.

The 10-minute version

If you only do five things today, do these. They would have stopped most of the hacks we cleaned up this year.

1. Update every plugin and theme, and delete the ones you don’t use.
2. Check your list of administrators and remove anyone you don’t recognise.
3. Turn on two-factor login for every administrator.
4. Block PHP in the uploads folder and web access to wp-content/upgrade.
5. Make sure you have a backup stored off the server, from before today.

The free Moatline Malware Scanner checks your site for all of these on its Malware Scanner → Advisor page and fixes most with one click.

1. Keep plugins, themes and WordPress updated

Out-of-date plugins are the single biggest cause of hacked WordPress sites. Once a fix is public, attackers compare the old and new code to work out the flaw, so the gap between “fixed” and “attacked” can be days.

• Update weekly at least, and the same day when a plugin you use is on our list of plugins under active attack. Our monthly plugin security updates you shouldn’t skip lists the fixes to install first.
• Turn on automatic updates for well-maintained plugins (Plugins → Enable auto-updates). Keep backups so you can roll back if one breaks something.
• Delete plugins and themes you don’t use. Deactivated plugins can still be attacked, because their files are still on the server. Keep one default theme as a fallback and delete the rest.
• Replace abandoned plugins. A plugin with no update for two years, or one closed on WordPress.org, won’t get security fixes.
• Check paid plugins separately. Premium plugins only show updates while their license is active.

2. Protect your logins

Bots try passwords on every WordPress site, all day. Stolen passwords from other breaches are the second most common way in.

• Use a unique, long password for every admin account, stored in a password manager. Never reuse your email or hosting password.
• Turn on two-factor login for administrators. Moatline includes it free: each admin sets it up under Users → Profile with any authenticator app.
• Limit failed logins. Moatline locks an address out for 20 minutes after 5 wrong tries.
• Hide usernames from scanners. Bots read them from /?author=1 and the REST API, then only need the password.
• Consider a private login address if only a few people log in. It doesn’t stop a targeted attacker, but it removes almost all bot traffic. Write the new address down.

3. Fewer admins, smaller roles

Every administrator account is a full key to the site. Attackers who get in almost always create one of their own, often hidden from the Users screen.

• Review your administrators once a month and remove old developers, agencies and staff who have left. See how to check for hidden admin users.
• Give people the smallest role that works: Editor for content, Shop Manager for orders, Author for writers.
• Write and edit posts with an Editor account, not your admin one. Some 2026 attacks wait for a signed-in administrator to open a page, then install a plugin through their browser, as in the TRUST#GRAFT fake Cloudflare check.
• Check Settings → General. “New User Default Role” should be Subscriber, and “Anyone can register” should be off unless you run a shop, course or membership site.

4. Control what gets installed

2026 has been the year the update itself became the attack. Rank Math PRO, UpdraftCentral keys and at least five other plugins sent malicious code through their normal update channel. See our timeline of WordPress supply-chain attacks.

• Only install from WordPress.org or the developer’s own site. “Nulled” or free copies of paid plugins nearly always contain a backdoor.
• Be wary of plugins you didn’t install. Fake security, cache and branding plugins are a favourite hiding place. See fake WordPress security plugins.
• Lock plugin installs when you aren’t working on the site. Moatline’s Lock blocks new plugins, theme uploads and new administrators until you unlock it, so a stolen login or a malicious script can’t add a backdoor.
• Turn off the built-in file editor. It lets anyone with an admin login edit PHP from the browser. Turn it off in Moatline’s Settings, or add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.

5. Close the folders attackers use

• Block PHP in wp-content/uploads. Uploads only needs images and documents. With PHP blocked, an uploaded web shell can’t run.
• Block web access to wp-content/upgrade. WordPress never opens it from the web. The WordPress 7.1.4 flaw let attackers run code there during updates, and over 240,000 attempts have been blocked since October.
• Set sensible file permissions: 644 for files, 755 for folders, and 600 or 640 for wp-config.php. Never 777.

Moatline adds the first two rules for you on Apache and LiteSpeed, and shows the rule to copy on Nginx.

6. Turn off what you don’t use

• XML-RPC: an old remote-access system used for password guessing and pingback attacks, including the HTTP2Shell (Brotli) server flaw. Turn it off unless you use Jetpack or a mobile app that needs it. Moatline can allow it for Jetpack only.
• Pingbacks and trackbacks: turn them off in Settings → Discussion.
• Unused accounts, plugins and themes: delete them rather than leaving them deactivated.

7. Hosting and PHP

• Use a PHP version that still gets security fixes. In late 2026 that means PHP 8.2 or newer, and 8.2’s fixes end on 31 December 2026, so plan a move to 8.3 or newer. Your host’s control panel shows and changes it.
• Keep sites separate. On one hosting account, one hacked site can infect all the others. Give important sites their own account, or at least their own database user.
• Use HTTPS everywhere. It protects logins on public Wi-Fi. It doesn’t stop hacking on its own.
• Pick a host that patches its servers and tells you when something goes wrong. Server software has its own flaws, as the PHP2Shell and Brotli flaws showed this year, and you can’t fix those from WordPress.

8. Backups you can actually restore

• Store backups off the server, for example in Google Drive, Dropbox or S3. Malware that deletes files often deletes local backups too.
• Back up daily if the site takes orders or posts often, weekly if it rarely changes.
• Keep at least 30 days. Most infections we clean had been on the site for weeks before anyone noticed, so last night’s backup may already be infected.
• Test a restore once, on a staging copy. A backup you’ve never restored is a guess.

If the worst happens and there’s no backup, a site can sometimes be rebuilt from its database, but it’s a lot more work.

9. Find out fast

No site is impossible to hack. What matters is noticing in hours, not months.

• Scan for malware weekly. How to scan WordPress for malware covers what a proper scan checks. Moatline Pro adds a daily automatic scan.
• Turn on email alerts. Moatline emails you within minutes when a new plugin is installed or a file appears in mu-plugins, the two places backdoors are usually added.
• Add the site to Google Search Console. Google emails you if it finds hacked content or malware, often before you would notice. See “This site may be hacked” in Google.
• Check the site from outside now and then, logged out and on a phone. Some malware hides from logged-in admins. Our free online check shows what visitors and Google see.

What doesn’t help much

These turn up on most checklists but do little against real attacks. They’re fine to do, just don’t count on them.

• Changing the database prefix from wp_. Attacks that reach your database read the prefix from wp-config.php.
• Hiding the WordPress version. Bots try every exploit on every site anyway.
• Renaming the “admin” user on its own. It helps a little, but a strong password and two-factor login matter far more.
• Installing several security plugins. They overlap, conflict and slow the site. One good one, set up properly, is better.

Don’t want to do this yourself? Our team cleans hacked WordPress sites every week: WordPress malware removal service, from $45, usually done within 24 hours.

Frequently asked questions

More guides

• WordPress malware keeps coming back: the file that rebuilt it from the database
• Fake WordPress security plugins: a real case from four hacked sites
• How to remove malware from WordPress
• WordPress site hacked? What to do in the first hour
• How to scan WordPress for malware
• WordPress update failed: how to fix it safely

All guides →