WordPress powers millions of websites, but keeping a WordPress website secure requires regular maintenance and the right security practices. A secure website isn’t achieved by installing one security plugin—it requires multiple layers of protection, from strong passwords and updates to backups, secure hosting, and login protection.

In this WordPress security hardening checklist, we’ll cover the most important steps you should take to protect your website from common attacks and reduce security risks. WordPress itself recommends keeping the core, themes, and plugins updated and using trusted software sources.

1. Keep WordPress Updated

Always keep WordPress core updated to the latest supported version. Security vulnerabilities are regularly discovered and patched, so running an outdated version can leave your website exposed.

Also update your themes and plugins regularly, especially plugins that handle sensitive information or user authentication.

2. Use Strong Passwords and 2FA

Use long, unique passwords for your WordPress administrator, hosting account, database, and other important services.

For administrator accounts, enable two-factor authentication (2FA) whenever possible. It adds another layer of protection even if someone manages to obtain your password. WordPress’s current security guidance also recommends strong passwords, 2FA, and considering passkeys for stronger authentication.

3. Remove Unused Plugins and Themes

Don’t keep plugins or themes installed simply because you might use them later. Unused software can become an unnecessary security risk, particularly if it is no longer maintained or updated.

Delete plugins and themes you don’t need, and only install software from trusted developers and reputable sources.

4. Protect the WordPress Login

The WordPress login page is a common target for automated brute-force attacks.

Use strong passwords, 2FA, login rate limiting, and a firewall or WAF where appropriate. CAPTCHA or similar bot protection can also help reduce automated login attempts.

Changing or hiding the login URL may reduce automated noise, but it should never be considered your main security measure.

5. Enable HTTPS

Make sure your website uses HTTPS with a valid SSL/TLS certificate.

HTTPS encrypts communication between visitors and your website and is particularly important for login pages, checkout pages, forms, and other areas where sensitive information is transmitted.

6. Create Regular Backups

A backup is one of the most important parts of your security strategy.

Create regular backups of both your WordPress files and database and, ideally, keep copies in a separate location from your hosting server.

A good backup strategy gives you a recovery option if your website is hacked, damaged, or accidentally misconfigured.

7. Use a Security Plugin or WAF

A reputable security plugin can provide features such as malware scanning, firewall protection, login monitoring, and suspicious activity detection.

For additional protection, an external Web Application Firewall (WAF) can block malicious traffic before it reaches your WordPress installation.

Don’t install multiple security plugins with overlapping firewall and scanning features unless you know exactly how they interact.

8. Disable Unnecessary File Editing

WordPress allows administrators to edit plugin and theme files from the dashboard by default.

If you don’t need this functionality, you can disable dashboard file editing with:

define( 'DISALLOW_FILE_EDIT', true );

This can help limit the damage if an administrator account is compromised.

9. Secure Your Hosting Environment

WordPress security doesn’t stop at the dashboard. Your hosting environment, PHP version, database, server configuration, and file permissions also matter.

Use a reputable hosting provider and keep server software maintained. WordPress currently recommends modern PHP and database versions as part of its hosting requirements.

For server access, use secure protocols such as SFTP instead of unencrypted FTP when available.

10. Monitor Your Website Regularly

Security is an ongoing process, not a one-time setup.

Regularly check:

• WordPress updates
• Plugin and theme updates
• Administrator accounts
• Login activity
• Security alerts
• Backup status
• Malware scans
• Hosting activity
• Unexpected files or changes

Also consider protecting or disabling XML-RPC if your website doesn’t require it, and use rate limiting where appropriate.

Final Thoughts

WordPress security is about reducing risk and preparing for recovery, not making a website completely impossible to attack.

By keeping WordPress updated, using strong authentication, removing unused software, protecting your login, enabling HTTPS, maintaining reliable backups, securing your hosting, and monitoring your website regularly, you can significantly improve your site’s security.

Use this checklist as part of your regular WordPress maintenance routine rather than treating security as a one-time task.