WordPress runs a huge share of the web, which is exactly why it attracts so much unwanted attention. As of 2026 it powers more than 43% of all websites and holds the largest slice of the CMS market by a wide margin. That reach is a strength, but it also means automated bots are constantly probing WordPress sites for weak passwords, outdated plugins and known vulnerabilities. The good news: the overwhelming majority of successful attacks exploit basic, preventable weaknesses. Get the fundamentals right and you close the door on almost all of them.

This guide walks through the security measures that genuinely matter in 2026, explains why they work, and is honest about the ones that have been oversold over the years. You do not need to be a developer to apply most of it. You do need to be consistent.

Start With What Actually Gets Sites Hacked

Before diving into settings, it helps to know where real-world compromises come from. Year after year, post-incident reports point to the same short list:

Outdated software. Vulnerable plugins, themes and, less often, out-of-date core are the single biggest cause of hacked WordPress sites.
Weak, reused or stolen passwords. Brute-force and credential-stuffing attacks succeed because people reuse passwords that have already leaked elsewhere.
Poorly coded or abandoned plugins. Nulled (pirated) plugins and extensions that no longer receive updates are a common entry point.
Weak hosting. Shared environments with poor isolation let one compromised site infect its neighbours.

Notice what is not on that list: exotic, sophisticated hacks. Prioritise the fundamentals below in roughly this order and you address the causes that account for the vast majority of incidents.

Use Strong, Unique Passwords and a Password Manager

Passwords remain the front door to your site, and weak credentials are one of the most common ways attackers get in. The fix is straightforward:

Use a long, unique password for every WordPress login, and never reuse it on another service.
Let a reputable password manager such as Bitwarden or 1Password generate and store them. A random 16-plus character password you never have to remember beats a clever one you reuse everywhere.
Insist that every user with an account, not just administrators, follows the same rule. A single weak editor account can undo everything else.

A password manager also removes the temptation to write passwords in a document or browser note, and it makes rotating a compromised password painless.

Turn On Two-Factor Authentication

Two-factor authentication (2FA) is the highest-value security upgrade most sites are still missing. Even if an attacker obtains a valid password through a leak or a phishing email, 2FA stops them at the login screen because they also need a time-based code from your phone or a hardware key.

Enable 2FA for every administrator and editor account at minimum.
Prefer an authenticator app (such as Google Authenticator or Authy) or a hardware security key over SMS codes, which can be intercepted.
Many reputable security plugins include 2FA, so you rarely need a separate tool.

Apply Least-Privilege User Roles

WordPress ships with a sensible set of roles, and the safest approach is to give each person the lowest level of access their job requires. An account that can only do less is an account that can do less damage if it is ever compromised.

Reserve the Administrator role for the few people who truly need to manage the whole site.
Give content contributors the Editor, Author or Contributor role instead.
Avoid the classic mistake of using the default admin username. Create a unique administrator username and delete or demote any generic admin account, since it is the first thing brute-force bots try.
Review your user list regularly and remove accounts for people who have moved on. Stale accounts are easy to forget and easy to abuse.

Keep Core, Plugins and Themes Updated

Updates are not just about new features. Most releases patch security vulnerabilities, and attackers actively scan for sites still running the old, exploitable versions. This is the discipline that prevents the largest category of compromises.

Keep WordPress core current. Minor security releases install automatically by default, and you should apply major versions promptly after a quick check.
Update plugins and themes regularly rather than letting them drift for months.
Test significant updates on a staging copy first where possible, so a rare breaking change never takes down your live site.
Always keep a recent, working backup before major updates so you can roll back if needed.

Install Only Reputable Plugins and Themes, and Remove the Rest

Every plugin and theme is code running on your site, so each one is a potential liability. Quality and maintenance matter far more than quantity.

Choose extensions that are actively maintained, well reviewed, and updated recently. Check the last-updated date and the developer’s track record.
Never install nulled or pirated premium plugins and themes. They are a notorious source of hidden malware and backdoors.
Deactivate and delete anything you are not using. Deactivated code can still be exploited, so removing it entirely is safer.
Keep the total number of plugins as low as is practical. A leaner site has a smaller attack surface and is easier to maintain.

Put a Web Application Firewall in Front of Your Site

A web application firewall (WAF) filters malicious traffic before it reaches WordPress, blocking common attacks such as SQL injection, cross-site scripting and aggressive brute-force attempts. It is one of the most effective protective layers you can add.

A cloud or edge WAF (for example, Cloudflare or Sucuri) stops bad traffic before it even hits your server and can absorb denial-of-service attacks.
A plugin-based firewall such as Wordfence runs inside WordPress and adds login protection, malware scanning and rate limiting.
Well-managed hosting often includes a server-level firewall, which is the least resource-intensive option of all.

A firewall does not replace updates and strong passwords. It buys you protection against automated attacks and, crucially, some breathing room when a new vulnerability is disclosed before you have patched.

Serve Everything Over HTTPS

HTTPS encrypts the connection between your visitors and your site, protecting login details and any data in transit from being intercepted. In 2026 it is a baseline expectation, not an optional extra, and browsers actively flag sites that lack it.

Install a TLS certificate. Let’s Encrypt provides them free, and most quality hosts issue and renew them automatically.
Force all traffic to https:// so there is no unencrypted version of your pages.
Confirm the padlock appears sitewide and fix any “mixed content” warnings caused by assets still loading over plain HTTP.

Take Regular, Tested Backups

Backups will not stop an attack, but they are what turns a potential disaster into a minor inconvenience. If the worst happens, a clean backup lets you restore quickly instead of rebuilding from scratch.

Back up files and database on a schedule that matches how often your site changes.
Store copies off-site, separate from your hosting account, so a server compromise cannot take your backups with it.
Test a restore occasionally. A backup you have never verified is a promise, not a safety net.
Keep several historical versions, since some infections go unnoticed for a while and you may need to reach back past the point of compromise.

Choose Hardened, Well-Managed Hosting

A large part of your security posture is decided by your host before you touch a single setting. Good hosting quietly handles many of the hardest problems for you.

Look for strong isolation between accounts, so a neighbour’s compromised site cannot reach yours.
Favour hosts that provide a server-level firewall, malware scanning, automatic TLS and regular platform patching.
Prefer providers that keep PHP and server software current and offer easy staging environments.
Automatic, off-site backups managed by the host are a strong signal you are in capable hands.

What About Changing the Database Prefix and Hiding the REST API?

Older security guides, including earlier versions of this one, placed heavy emphasis on tricks like changing the default wp_ database table prefix or disabling parts of the REST API. It is worth being honest about these in 2026.

Changing the wp_ table prefix is now widely regarded as low-value. It does not prevent SQL injection: a properly patched, well-coded site is protected because queries are written safely, not because table names are hard to guess. Changing the prefix on an existing site can even break things if done carelessly. It is, at best, minor obscurity, not real protection. Keeping your software updated and running a firewall is what actually stops SQL injection.
Restricting the users REST API endpoint can modestly reduce username enumeration, but on its own it is a small measure. It does nothing if your accounts have weak passwords and no 2FA. Treat it as a minor extra, not a substitute for the fundamentals above, and be aware that many plugins and features rely on the REST API, so blunt attempts to disable it can cause breakage.

None of this is harmful in itself, but it should never crowd out the measures that genuinely move the needle. Spend your effort on passwords, 2FA, updates, backups and hosting first.

A Simple Security Checklist

If you do nothing else, work through this list in order:

Strong, unique passwords in a password manager for every account.
Two-factor authentication on all admin and editor logins.
Least-privilege roles, and no generic admin account.
Core, plugins and themes kept up to date.
Reputable, actively maintained plugins only, with unused ones removed.
A web application firewall in front of your site.
HTTPS enforced sitewide.
Regular, off-site, tested backups.
Hardened, well-managed hosting.

Conclusion

WordPress security is not about one clever setting or a single plugin. It is a set of sensible habits applied consistently: keep everything updated, control who can log in and how, filter hostile traffic, encrypt connections, and always have a backup you can trust. Get those fundamentals right and you will be safer than the large majority of sites on the web, because most attacks target the ones that skipped the basics.

If keeping on top of all this sounds like a lot to manage, that is exactly the gap WPGuard exists to fill. Rather than relying on an automated tool alone, WPGuard has experienced people looking after your site: applying updates carefully, monitoring for threats, running managed firewalls and backups, and cleaning up quickly if anything ever slips through. It is the same practical, methodical approach to WordPress security and hosting, refined over more than 20 years, put to work so you can get on with running your business.

WordPress Security – The Fundamentals Every Webmaster Can Implement