🔒 Security
The WordPress Security Checklist (2026 Edition)
WordPress powers 40%+ of the web, which makes it a target. Most hacks exploit the same handful of weaknesses. Here is how to close them.
Logins
- Use a unique admin username (never "admin").
- Enable two-factor authentication.
- Limit login attempts and block repeated failures.
Updates
- Keep core, themes, and plugins updated — 90%+ of hacked sites run outdated software.
- Delete unused themes and plugins — they are attack surface with zero benefit.
Server-level
- File permissions: 644 for files, 755 for directories.
- Disable PHP execution in the uploads directory.
- Use SFTP/SSH, never plain FTP.
Backups and monitoring
- Automated daily backups stored offsite.
- A security plugin for malware scanning and file-change alerts.
Do these 15 things and you are safer than 95% of WordPress sites on the internet.
