Originally published: October 1, 2023 · Last updated: August 14, 2026
WordPress security is not one plugin or one setting. It is a routine built around updates, strong access control, reliable backups and a hosting environment that is actively maintained. Most site owners do not need an elaborate security stack, but they do need consistent basics.
1. Keep WordPress current
WordPress, themes and plugins receive updates for compatibility, bugs and security issues. Running old software increases the time a known problem remains exposed. Review updates regularly and remove software you no longer use.
2. Use strong, unique passwords
Every administrator should use a unique password that is not reused on email, hosting or other services. A password manager makes this practical and removes the temptation to rely on memorable but weak passwords.
3. Add multi-factor authentication
A second authentication factor adds useful protection when a password is stolen or reused elsewhere. Prioritize administrator and hosting accounts first, then expand to other privileged users where practical.
4. Give users only the access they need
Not every contributor needs administrator rights. WordPress roles exist for a reason. Give people the lowest level of access that lets them do their work, and remove accounts when a project or collaboration ends.
5. Choose actively maintained plugins and themes
Install software from sources you trust and check whether it is still maintained. A small, well-understood plugin stack is easier to update and audit than a site filled with abandoned extensions.
6. Use HTTPS everywhere
A valid HTTPS configuration protects traffic between visitors and the site. The WordPress Address, Site Address, redirects and embedded resources should all use the intended secure version of the domain.
7. Maintain independent backups
Security planning includes recovery. Keep scheduled backups of both the database and site files, store them somewhere independent from the live site, and test that a restoration procedure actually works.
8. Protect the hosting account too
A secure WordPress login does not help if the hosting control panel, domain registrar or primary email account is poorly protected. Use strong authentication on the services that can reset passwords, change DNS or modify the server.
9. Monitor for unexpected changes
Know what normal looks like. Unexpected new administrators, unexplained plugin installations, sudden redirects, modified pages or unusual traffic deserve investigation. Site monitoring and hosting alerts can help surface problems earlier.
10. Have a recovery plan
Write down what you would do if the site became unavailable or compromised. Know where backups are stored, who controls the domain, how to contact the host and which services need credentials. Recovery is much easier when those decisions are made before an incident.
What not to overcomplicate
Security advice often encourages site owners to make many obscure configuration changes. Complexity is not automatically safer. Every unusual modification creates another thing to remember, maintain and troubleshoot.
Start with the fundamentals: current software, limited access, strong authentication, backups and reputable hosting. Add more controls when the site’s risk profile justifies them.
The practical rule
A secure WordPress site is usually the result of disciplined maintenance rather than a collection of dramatic tweaks. Reduce the number of things that can go wrong, protect the accounts that matter most, and make sure you can recover cleanly if something still does.
Official reference: WordPress Hardening guide.