WordPress Security Hardening Checklist 2026

WordPress powers roughly 40% of the web, which makes it the most-attacked CMS. Most breaches come from outdated plugins, weak credentials, and exposed configuration files — all of which are preventable. Here is the highest-impact checklist for 2026.

1. Keep core, themes, and plugins updated

Enable automatic updates for security releases. Delete plugins and themes you don't use — inactive code is still attackable.

2. Protect wp-config.php

Move secrets out of the web root where possible and block direct access. In .htaccess:

<Files wp-config.php>
  Require all denied
</Files>

3. Lock down sensitive files

Make sure these never return HTTP 200: /wp-config.php.bak, /.env, /backup.zip, /.git/config. VitalSite probes 50+ such paths automatically.

4. Enforce strong auth

Use unique strong passwords, enable two-factor authentication, and limit login attempts. Rename or protect /wp-admin with an extra layer.

5. Add security headers

WordPress doesn't set CSP, HSTS, or X-Frame-Options by default. Add them at the server or via a plugin.

6. Disable XML-RPC if unused

xmlrpc.php is a common brute-force and DDoS vector. Block it unless you specifically need it.

7. Use HTTPS everywhere

Force HTTPS, fix mixed-content warnings, and set the WordPress Address and Site Address to https://.

Run a VitalSite scan to see which of these your site is missing, with exact wp-config and .htaccess snippets.