Almost every other inquiry I get starts the same way: “My site was acting weird - is it hacked?” Usually the answer is: not necessarily, technically, but it’s not secure either. WordPress is solidly built out of the box, but a website’s security almost always comes down to the settings nobody touches again after launch.
The good news: you don’t need an IT degree to noticeably improve your WordPress security in 2026. The following ten steps are exactly what I check first with every maintenance client - work through them in order and you’ll need an afternoon.
The 10 steps to better WordPress security
1. Consistently keep core, themes, and plugins up to date
Most successful attacks on WordPress sites don’t exploit new, spectacular vulnerabilities - they exploit known weaknesses in outdated plugins that have had an update available for months. Enable automatic updates for security patches and manually check at least once a month that core, theme, and all active plugins are current. Important: test major updates in a staging environment before they go live - more on that soon in a dedicated post.
2. Use strong, unique passwords
“admin123” is still shockingly common in 2026. Every user account needs an individual, long password - ideally from a password manager. If you manage multiple client websites, a team password manager is worth it, so nobody’s sending credentials around in text files or emails.
3. Enable two-factor authentication
Even a strong password can leak. With two-factor authentication (2FA), login stays protected because a second factor - like an app such as Google Authenticator - is required. Reliable, free plugins exist for WordPress; setup rarely takes more than ten minutes.
4. Lock down the login area
Brute-force bots try credentials against the standard /wp-admin login around the clock. Three measures help immediately: limit the number of failed login attempts (rate limiting), temporarily block IP addresses after several failed attempts, and optionally change the login URL to a custom address. None of these measures is unbeatable on its own - but combined, they make things significantly harder for attackers.
5. Use an SSL certificate and enforce HTTPS
Without an SSL certificate, data between browser and server is transmitted unencrypted - including login data. Most hosts provide free certificates (e.g. via Let’s Encrypt). Important: HTTPS should be enforced server-side, so nobody accidentally ends up on the unencrypted HTTP version.
6. Use a firewall and malware scanner
A web application firewall filters suspicious traffic before it even reaches WordPress, and a malware scanner alerts you as soon as files change unexpectedly. Both can be covered with established security plugins - I compare which ones hold up in practice in a dedicated post.
7. Set up regular, tested backups
Security isn’t just “prevent attacks” - it’s also “be able to recover quickly if something goes wrong.” A backup is only really a backup if it runs automatically, is stored off your own server, and is regularly tested for restorability. How often that should happen depends on how frequently your site changes.
8. Assign user permissions carefully
Not everyone who needs access to WordPress needs administrator rights. The principle of least privilege - every account gets only as much access as necessary - limits the damage if an account is ever compromised. Former employees or contractors should also consistently lose their access as soon as the working relationship ends.
9. Remove unnecessary plugins and themes
Every installed plugin is a potential additional attack surface - even if it’s deactivated but not deleted. Clean up regularly: what’s actually being used? What’s a test from two years ago that was never uninstalled? Less installed software automatically means a smaller attack surface.
10. Set up security and uptime monitoring
The last point, and in my view an underrated one: you shouldn’t find out something’s wrong from a customer email. A monitoring tool checks around the clock whether the site is reachable and raises the alarm on downtime or suspicious changes - I run a self-hosted Uptime Kuma setup in the background for every client site.
Conclusion
None of these ten steps is complicated on its own - the real challenge is doing them consistently and regularly, instead of checking them off once. That’s exactly what ongoing WordPress maintenance is for: not a one-off action, but a fixed routine running in the background. I’ve broken down what that kind of maintenance realistically costs in a separate post: What does WordPress maintenance cost?
If you’re not sure where your site currently stands: I offer a free, no-obligation WordPress security check - just reach out via the contact form.
