security9 min readBy Website Auditor ResearchUpdated 2026-01-02
WordPress Security Hardening: The 2026 Checklist
WordPress powers a huge chunk of the web and, being popular, is a huge target. Here is what to lock down first.
Automatic updates
Enable core, plugin and theme auto-updates. Test in staging weekly. Most WordPress compromises exploit known bugs with patches available for months.
Security headers
Add HSTS, CSP, X-Content-Type-Options and Referrer-Policy at the web server or Cloudflare layer, not via plugin. Plugins can be disabled; server config can't.
Plugins
Every plugin is a supply-chain risk. Remove what you don't use. Prefer plugins with recent updates and a real maintenance team.
Logins
Change /wp-login.php path or add basic auth in front of it. Enable MFA on every account with publish rights.