How to Secure WordPress: The Complete 2026 Checklist
Secure your WordPress site: updates, two-factor login, plugin hygiene, wp-config.php hardening, file permissions, backups and a firewall, by priority.
Blog topic
Secure a WordPress site
Updates, 3-2-1 backups, HTTPS, firewalls, two-factor authentication: our guides to protect a WordPress site from hacks and data loss, with checklists you can apply right away.
- 1 article
Categories
Start here
WordPress security rests on a few simple rules applied without exception: keep everything updated, back up off the server, encrypt traffic and protect logins. Our articles cover each of them in detail.
Automated attacks mostly exploit three weaknesses: an outdated plugin or theme, a weak or reused administrator password, and no usable backup on the day you need to restore. Fixing those three points already stops most automated attacks.
The minimum checklist
- Update WordPress, plugins, the theme and the PHP version as soon as security fixes are released.
- Turn on two-factor authentication for every administrator account and delete unused accounts.
- Keep at least one backup off the server and test a restore once a quarter.
- Serve the whole site over HTTPS with a valid SSL certificate and a 301 redirect.
- Delete deactivated plugins and themes: inactive code can still be attacked.
At Hosterwise, sites are backed up every day to storage kept apart from their server, SSL certificates are free and a malware scan runs daily. The details are on the features page.
Useful pages
Key terms
All articles
How to Secure WordPress: The Complete 2026 Checklist
Secure your WordPress site: updates, two-factor login, plugin hygiene, wp-config.php hardening, file permissions, backups and a firewall, by priority.