WordPress Hardening Checklist for 2026

WordPress remains one of the most attacked platforms on the web, mostly because it is everywhere and most installs are left at default settings. The good news is that the majority of real-world attacks fail against a handful of straightforward configurations.

1. Lock down the admin area

• Rename or restrict access to wp-login.php using a plugin like WPS Hide Login or via web server rules.
• Enforce strong passwords and turn on two-factor authentication for every admin and editor account.
• Limit failed login attempts to throw off credential stuffing.

2. Disable what you do not use

• Disable XML-RPC unless you actively use it — it is a frequent target for amplification and brute-force attacks.
• Disable file editing inside the dashboard with define('DISALLOW_FILE_EDIT', true); in wp-config.php.
• Disable directory listing in your web server configuration.

3. File permissions and ownership

The defaults most hosts ship with are too permissive. As a baseline:

find . -type d -exec chmod 755 {} \;
find . -type f -exec chmod 644 {} \;
chmod 600 wp-config.php

4. Keep core, themes and plugins updated

The single largest source of WordPress compromise remains outdated plugins. Set up automatic minor updates and review major updates monthly. Remove anything you do not actively use.

5. Headers and CSP

Add a baseline of security headers via your web server or a plugin: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options, Referrer-Policy. Most attacks against admin sessions and content injection rely on the absence of these.

If you only do three things this quarter: enforce 2FA, restrict the login URL, and patch every plugin. Those three alone block most real-world WordPress attacks.