WordPress Security Checklist: 10 Steps to Harden Your Site in 2026

Most WordPress sites get hacked not because of sophisticated attacks — but because of basic security steps that were never taken.

This checklist covers the 10 most important things you can do right now to harden your WordPress site. No security expertise required.

1. Keep WordPress, Themes, and Plugins Updated

This is the single most important security step and the one most commonly skipped.

Over 60% of hacked WordPress sites were running outdated software at the time of the breach. Updates patch known vulnerabilities — leaving them unpatched is like locking your front door but leaving the window open.

What to do:

• Go to Dashboard → Updates and apply everything pending
• Enable automatic updates for minor WordPress versions
• Delete plugins and themes you don’t actively use — inactive code is still vulnerable code

2. Use Strong, Unique Passwords and a Password Manager

“admin123” and “softcrony2024” are not passwords. They’re invitations.

Every WordPress account — admin, editor, author — needs a unique, randomly generated password of at least 16 characters. Use a password manager like Bitwarden (free) or 1Password to generate and store them.

What to do:

• Go to Users → All Users and force password resets for all accounts
• Install Bitwarden browser extension — it’s free and open source
• Never reuse passwords across different sites or services

3. Change the Default Admin Username

When WordPress is installed, the default username is often “admin”. Attackers know this and use it as the first guess in brute force attacks.

What to do:

• Create a new admin user with a different username
• Log in as the new user
• Delete the original “admin” account (reassign posts to the new user)

4. Enable Two-Factor Authentication

Even if an attacker gets your password, 2FA stops them from logging in without physical access to your phone or authenticator app.

What to do:

• Install the WP 2FA plugin (free)
• Enable 2FA for all admin accounts
• Use an authenticator app like Google Authenticator or Authy — not SMS

5. Limit Login Attempts

By default, WordPress allows unlimited login attempts. This makes brute force attacks — trying thousands of password combinations — trivially easy.

What to do:

• Install Limit Login Attempts Reloaded (free plugin)
• Set lockout after 5 failed attempts
• Set lockout duration to 30 minutes
• Enable email notification for lockouts

6. Install an SSL Certificate

If your site still runs on HTTP instead of HTTPS, fix this immediately. An SSL certificate encrypts data between your site and visitors — and Google actively penalises sites without it.

What to do:

• Most hosting providers (cPanel, Hostinger, SiteGround) offer free Let’s Encrypt SSL — enable it in your hosting panel
• Install the Really Simple SSL plugin to handle the WordPress side
• Verify by checking for the padlock icon in your browser address bar

7. Disable XML-RPC If You Don’t Use It

XML-RPC is a WordPress feature that allows remote connections — including the Jetpack plugin and mobile apps. If you don’t use these, XML-RPC is just an open attack surface.

Attackers use XML-RPC to run brute force attacks because it allows multiple login attempts per request, bypassing login attempt limits.

What to do:
Add this to your .htaccess file:

# Disable XML-RPC
<Files xmlrpc.php>
  Order Deny,Allow
  Deny from all
</Files>

Or install the Disable XML-RPC plugin if you’re not comfortable editing .htaccess.

8. Set Correct File Permissions

Incorrect file permissions are a common entry point for attackers. WordPress files and folders should have specific permission levels.

Correct permissions:

• Folders: 755
• Files: 644
• wp-config.php: 440 or 400

What to do:

• Access your server via FTP or cPanel File Manager
• Right-click wp-config.php → Change Permissions → set to 440
• Your hosting provider’s support team can help if this is unfamiliar

9. Regular Backups — Automated and Off-Site

No security measure is 100% effective. Backups are your last line of defence — but only if they’re automatic, recent, and stored somewhere other than your main server.

What to do:

• Install UpdraftPlus (free) — the most widely used WordPress backup plugin
• Configure automatic daily backups
• Store backups to Google Drive or Dropbox — not just your hosting server
• Test a restore at least once to confirm your backups actually work

10. Use a Web Application Firewall (WAF)

A WAF filters malicious traffic before it reaches your WordPress site — blocking known attack patterns, bad bots, and suspicious requests.

Free options:

• Cloudflare Free plan — adds a WAF, CDN, and DDoS protection at the DNS level. This is our first recommendation for any WordPress site in India because it also significantly improves page speed.
• Wordfence (free tier) — a WordPress plugin that adds a firewall and malware scanner directly in WordPress

What to do:

• Sign up for Cloudflare (free) at cloudflare.com
• Add your domain and update your nameservers at your domain registrar
• Enable the WAF rules in the Cloudflare dashboard

Quick Reference Checklist

How We Handle Security at Softcrony

For every WordPress site we build or maintain, these 10 steps are part of our standard delivery checklist. Security isn’t an add-on — it’s built into the process from day one.

If you’d like a security audit of your existing WordPress site, or want us to implement these steps for you, get in touch with our team.