WordPress security checklist 2026: 15 things to lock down before launch

WordPress runs a huge share of the websites on the internet, and that popularity cuts both ways. It means a mature ecosystem of themes, plugins, and hosting — and it means automated bots are constantly scanning for the same handful of weaknesses across millions of sites at once. Most successful attacks are not sophisticated. They are opportunistic scripts finding an unlocked door.

The good news is that WordPress security is mostly a checklist problem, not a technical one. Almost every compromise we get called in to clean up traces back to a handful of missed basics — a weak password, an outdated plugin, no backups. This is the checklist we run before every site goes live.

Why this matters more than people assume

A hacked WordPress site is rarely just an inconvenience. Google will often flag a compromised site in search results and in Chrome, which tanks traffic overnight. Hosts frequently suspend infected accounts until they are cleaned. Malware injected into a site can silently redirect visitors, mine data, or send spam through your domain's reputation — damage that outlasts the fix itself. Locking these things down before launch takes an afternoon. Cleaning up after a breach takes days and does not always fully undo the reputational hit.

The 15-point WordPress security checklist

1. 1.Use strong, unique admin credentials and enable two-factor authentication
2. 2.Keep WordPress core, themes, and plugins updated at all times
3. 3.Limit login attempts to block brute-force attacks
4. 4.Disable file editing from within wp-admin
5. 5.Set correct file and folder permissions
6. 6.Remove unused plugins and themes entirely, not just deactivate them
7. 7.Install a reputable security plugin or WAF (Wordfence, Sucuri)
8. 8.Disable XML-RPC if it is not actively used
9. 9.Hide WordPress version information from public view
10. 10.Change the default 'wp_' database table prefix
11. 11.Schedule regular, automated offsite backups
12. 12.Enforce HTTPS/SSL sitewide with no mixed content
13. 13.Disable directory listing on the server
14. 14.Restrict wp-admin access by IP address where feasible
15. 15.Set up monitoring and logging so you know when something changes

The highest-impact items, explained

Not all 15 items carry equal weight. If you only have time for a handful before launch, prioritize these.

1. Strong credentials and two-factor authentication

'Admin' as a username and a memorable password is still shockingly common, and it is the first thing automated attacks try. Use a unique, non-obvious username, a long randomly generated password stored in a password manager, and two-factor authentication on every account with publishing or admin access. 2FA alone stops the overwhelming majority of credential-stuffing attempts, because a leaked or guessed password is no longer enough on its own.

2. Keep core, themes, and plugins updated

The majority of WordPress compromises exploit a known, already-patched vulnerability in an outdated plugin or theme. Attackers scan for version numbers and target sites that have not applied a fix that has been public for weeks or months. Enable automatic updates for minor core releases, and review plugin and theme updates weekly rather than letting them queue up for months. A staging environment makes this safe to do without fear of breaking the live site.

3. Limit login attempts

Without a limit, wp-login.php will happily accept unlimited password guesses, which is exactly what brute-force bots rely on. A login-attempt limiter (built into most security plugins) locks out an IP after a handful of failed tries, which turns a brute-force attack from a real threat into a non-event. This is a five-minute setup with an outsized payoff.

7. A reputable security plugin or WAF

Wordfence and Sucuri are the two most established options, and both do the same core job: a web application firewall that filters malicious requests before they reach WordPress, malware scanning, and alerting when something changes unexpectedly. A WAF at the network level (Cloudflare or Sucuri's firewall) is even better, because it blocks bad traffic before it hits your server at all. Pick one, configure it properly, and keep its rules updated — a security plugin installed and never configured provides a false sense of protection.

11. Regular, automated offsite backups

Backups are not really a security measure — they are what makes every other security measure recoverable if it fails. If a site is compromised, the fastest and most reliable fix is often restoring a clean backup from before the infection, then patching the vulnerability that let it in. Store backups offsite (not on the same server as the site), automate them daily, and actually test a restore occasionally. A backup you have never restored is a backup you do not really have.

12. Enforce HTTPS sitewide

SSL is table stakes in 2026, but mixed content — a page loaded over HTTPS that still pulls an image, script, or stylesheet over plain HTTP — still trips up a surprising number of sites, particularly after a migration. Force HTTPS at the server level, update the WordPress site URL settings, and run a mixed-content scan after any domain or hosting change. Beyond the padlock icon, HTTPS also protects login credentials and form submissions from being intercepted in transit.

14. Restrict wp-admin access by IP where feasible

If your team logs in from a known set of locations — an office, a fixed set of remote IPs, a VPN — restricting wp-admin and wp-login.php to those IPs at the server or firewall level removes the login page as an attack surface entirely for everyone else. This is not always practical for teams with fully dynamic IPs, but where it is possible, it is one of the single most effective hardening steps on this list.

Security is not a one-time setup. A site hardened at launch and never revisited drifts back toward vulnerable as plugins update, team members change, and new threats emerge. Treat this checklist as a recurring quarterly review, not a launch-day formality.

What to do if you think you have already been compromised

Signs of compromise include unexpected admin users, unfamiliar files in your theme or plugin directories, a sudden spike in outbound traffic, Google Search Console flagging malware, or your host suspending the account. If you see any of these, isolate first: change all passwords, restore from the most recent clean backup if you have one, and only reconnect the site to the internet after the vulnerability that let the attacker in has been identified and patched — otherwise you are just inviting a repeat.

Make security part of maintenance, not an afterthought

Every site we build ships with this checklist applied by default — strong auth, a configured WAF, hardened file permissions, and automated offsite backups from day one, not bolted on after something goes wrong. Security is cheapest and most effective when it is a default, not a reaction.