WordSec
WordSec
Security

WordPress Security Checklist 2026: 37 Steps to a Locked-Down Site

A complete WordPress security checklist for 2026. 37 concrete steps across login, firewall, scanning, monitoring, and maintenance, most of them free.

WordSec Team
July 24, 202614 min read

WordPress security in 2026 is a race measured in hours. When a plugin vulnerability drops, exploitation campaigns follow within days, sometimes the same day, as the wp2shell pre-auth RCE wave demonstrated at scale. Meanwhile the background noise never stops: brute-force botnets, card testers, scrapers, and scanners work every reachable site around the clock, yours included.

The good news: defending against all of it is not guesswork. It is a finite list of doors to close, and this checklist walks through every one. The 37 steps below are grouped into seven areas, ordered roughly by impact. Nearly all of them can be completed with the free WordSec plugin from a single dashboard, and each section links to a deeper guide when you want the full reasoning.

Login and access security

The login is the most attacked surface on any WordPress site, so it comes first. All of these live in WordSec's Login Security module, and the detailed walkthrough is in How to Stop Brute Force Attacks on WordPress.

  1. Hide your login URL. Move the login off wp-login.php to a custom path. Most automated attacks target the default and give up when it returns a not-found response.
  2. Hide login error details. Default messages reveal whether the username or the password was wrong. Show attackers a generic message instead.
  3. Require two-factor authentication for privileged roles. With role-based 2FA, a leaked admin password stops being a site takeover.
  4. Add a captcha to login and registration. WordSec supports reCAPTCHA, Turnstile, and hCaptcha across five forms. Turnstile is a good friction-free default.
  5. Enable brute-force lockouts and honeypots. Failed-attempt limits ban persistent guessing, and honeypot fields expose bots instantly.
  6. Enforce a real password policy. Strong password requirements, a leaked-password check against breach lists, reuse prevention, and role-based expiry for sensitive accounts.
  7. Limit sessions. Set a maximum number of concurrent sessions, an idle timeout, and a sane remember-me duration, so a forgotten library login does not stay open forever.
  8. Restrict who can log in at all. Whitelist login by IP, CIDR range, or country, and apply role-based login time windows if your team works predictable hours.

Firewall and hardening

A web application firewall filters attacks before they reach your code. These steps live in WordSec's Firewall module; the full setup guide is How to Set Up a WordPress Firewall (WAF).

  1. Turn the WAF on. WordSec's firewall inspects every request against its rule set, with a learning mode for safe rollout and 50 rules included free.
  2. Block bad bots, AI scrapers, and vulnerability scanners. Most probing traffic identifies itself; let the firewall act on it.
  3. Enable security headers and iFrame protection. Hardened headers shut down clickjacking and a family of injection tricks in one step.
  4. Disable XML-RPC. One toggle closes the endpoint that lets attackers test hundreds of passwords per request. Details in How to Stop XML-RPC Brute Force Attacks.
  5. Sweep the hardening toggles. Block user enumeration, disable directory listing, turn off the plugin and theme file editor, force HTTPS, and hide version fingerprints. WordSec ships more than 25 of these switches.
  6. Control REST API access by role. Allow the namespaces your site needs and block the rest, closing off enumeration and unauthenticated abuse.

Traffic blocking

Not every request deserves a hearing. The Blocking module handles bulk refusal.

  1. Geoblock regions you never serve. Country and continent blocking is free in WordSec and cuts untargeted attack volume dramatically. Guide: How to Block a Country in WordPress.
  2. Enable rate limiting and 404/403 abuse protection. Clients that flood requests or generate error storms get banned automatically, with the reason logged.
  3. Block anonymizer traffic if abuse persists. Premium toggles block VPN, proxy, Tor exit, and blacklisted IPs, the networks ban evaders hide behind. Guide: How to Block VPN and Proxy Traffic.
  4. Review the banned list monthly. The reasons recorded for each ban tell you what kind of attention your site is getting, and whether your rules need tightening.

Malware scanning

Detection is what saves you when prevention misses. The Scanner module covers these; the evaluation criteria are in WordPress Malware Scanner: What Should You Look For?.

  1. Schedule scans to run daily. WordSec's seven-stage scan covers file integrity, versions, permissions and ownership, leftover backups and logs, malware signatures, cron tasks, and the database. Low resource mode keeps visitors unaffected.
  2. Act on file integrity findings. Added, deleted, and changed core files are the most reliable compromise indicator there is. Investigate every one.
  3. Use the quarantine workflow, not instant deletion. Quarantine disarms a file reversibly; verify with the safe content view and a VirusTotal lookup, then delete. Full process: How to Find Malicious Files in WordPress.
  4. Keep your scan history as a baseline. A clean history answers the question every incident starts with: when did this first appear?

Updates and supply chain

Vulnerable and abandoned extensions are the number one WordPress infection vector. The Supply Chain Security module watches this for you; background in How to Protect WordPress from Vulnerable Plugins and Themes.

  1. Update core, plugins, and themes promptly. The window between disclosure and mass exploitation keeps shrinking. Days, not weeks.
  2. Delete what you do not use. Deactivated plugins and themes still ship exploitable code. Remove them entirely.
  3. Check reputation before installing anything new. WordSec scores every plugin and theme on installs, update recency, compatibility, ratings, developer history, and vulnerability status. Read the score before you click install.
  4. Watch for abandonment. A plugin whose developer walked away two years ago is a vulnerability with a countdown. Abandoned and outdated alerts are free.
  5. Turn on vulnerability alerts. Premium alerts tell you the moment a known vulnerability is published for something you run, which is exactly the head start the vulnerability database exists to give.

Monitoring and alerts

You cannot respond to what you never see. Three modules make the site observable.

  1. Keep the audit log on and review it. The Audit Log tracks 14 action types across 11 object types: logins, user creation, installs, uploads, settings changes. It is your incident timeline before you need one.
  2. Spot-check Live Traffic. The Live Traffic module shows requests in real time and lets you replay history with safe request and response inspection. Five minutes a week builds the intuition that makes anomalies jump out.
  3. Wire the Alarm module to where you actually look. Real-time security alerts across 36 event types, delivered to email, Telegram, or Slack. Start with the Basic mode and escalate to Advanced or Full as you tune the signal.
  4. Enable the weekly security summary. The Premium digest turns your security posture into a habit instead of a crisis response.

Infrastructure and housekeeping

The unglamorous checks that decide how bad a bad day gets. Most live in WordSec's security toolbox.

  1. Keep off-site backups. No security plugin replaces backups, WordSec included. Use a dedicated backup tool or your host's snapshots, store copies off the server, and test a restore twice a year.
  2. Check your SSL health. The SSL check verifies certificate and header configuration in one click, and the Business-tier SSL monitor alerts you before a certificate expiry takes the site down.
  3. Test email deliverability. If your site's mail silently fails, you lose password resets and order confirmations, and you might not notice for weeks.
  4. Check your blacklist status. The reputation check queries whether your domain or server IP sits on abuse blocklists, an early symptom of compromise and a direct hit to your email and SEO.
  5. Optimize the database and check your table prefix. Routine optimization plus a quick check that you are not advertising default settings to automated attacks.
  6. Audit the basics: admin username and file permissions. The default admin username check and the file permissions audit close two of the oldest doors in the book.

A checklist run once is a snapshot; security is a schedule. The practical rhythm: automated scans and alarms run daily on their own, you glance at traffic and new registrations weekly, and you walk the full 37 points quarterly, because sites change and settings drift.

If you are starting from zero, the order above is the priority order. Steps 1 through 16 alone, all free, put you ahead of the vast majority of WordPress sites, and the complete security guide fills in the reasoning behind every layer.

Frequently asked questions

How do I secure my WordPress site in 2026?

Work the seven areas in order: lock down the login, enable the firewall and hardening toggles, block traffic you never want, schedule malware scans, keep the supply chain updated and monitored, wire up real-time alerts, and finish the infrastructure housekeeping. Every step above maps to a concrete setting.

How much of this checklist is free?

Thirty-three of the 37 steps use WordSec's free plan (plus a backup tool of your choice for step 32). The Premium items are anonymizer blocking, vulnerability alerts, and the weekly summary; the Business item is infrastructure monitoring like SSL and downtime alerts. See the pricing page for the breakdown.

Do I need a security plugin if my host is secure?

Yes. Hosts secure the server; the attacks above target the application: your login, your plugins, your REST API, your users. Application-layer defenses are the site owner's job, which is exactly what this checklist covers.

What is the single most important item?

If forced to pick one: updates (step 23), because vulnerable extensions are the leading infection vector. If allowed two: two-factor authentication, because credential attacks are the runner-up and 2FA neutralizes them almost entirely.

How often should I run through this checklist?

Automated layers run continuously once configured. Do the manual review quarterly, and immediately after any incident, migration, or team change. Settings drift, plugins accumulate, and a quarterly hour is cheap insurance.

Work through it today: install WordSec free, open the checklist next to your dashboard, and close the doors one by one. When you want the advanced layers, Premium and Business switch on with the same key.

Back to all posts