WordPress Security in 2026: 10-Point Checklist for Site Managers

WordPress security in 2026 depends on five essentials: updating plugins and themes without delay, two-factor authentication for every admin account, limiting login attempts, securing wp-config.php, and off-server backups. According to the Patchstack report published in February 2026, a record 11,334 vulnerabilities were added to the WordPress ecosystem in 2025 - 91% came from plugins and themes. The median time from vulnerability disclosure to first active attack is just 5 hours. This checklist gives you concrete steps to close these gaps.

Why WordPress security in 2026 is a bigger challenge than before

WordPress is the dominant platform - and that is exactly what makes it the most attractive target for automated attacks. According to W3Techs, in July 2026 41.5% of all websites worldwide run on WordPress. One working exploit hits thousands of sites at once - which is why bots continuously scan the internet and try known vulnerabilities on every available installation.

The numbers from the security industry are unambiguous. Patchstack - a company specialising in WordPress security - published its annual report State of WordPress Security in 2026 in February 2026. Key findings from 2025:

• 11,334 new vulnerabilities in the WordPress ecosystem - a record high, up 42% from 2024
• 91% of vulnerabilities come from plugins and themes; only 6 were found in WordPress core
• Median time from disclosure to first attack: 5 hours - that is your real window to patch
• 46% of vulnerabilities have no patch at the time of public disclosure
• Estimated number of WordPress sites hacked every day: 13,000

Good news: most attacks on a typical business website are not targeted. They are automated - a bot arrives, tries a few known exploits, finds nothing, and moves on. If you have basic measures in place, you are significantly safer than nine out of ten comparable sites.

If you built your site using AI tools, there is an additional layer of risk: generated code commonly leaves security gaps open. Security is the seventh point in our 7-point audit checklist for vibe-coded websites - if you haven't done it yet, start there.

WordPress security: 10-point checklist

These are concrete steps - not abstract advice - that reduce the risk of a successful automated attack on your site. WordPress.org in its Hardening WordPress guide (last updated January 2026) states that the most important step is keeping WordPress and extensions up to date. The remaining points are layers of defence that make an attacker's job harder at every step.

1. Update WordPress core, plugins, and themes immediately. With a 5-hour window from disclosure to first attack, every day of delay is measurable risk. Set up notifications when a new update is waiting.
2. Two-factor authentication (2FA) for all admin accounts. 2FA stops the vast majority of brute-force attacks regardless of password complexity. Set up for all users with Editor permissions and above.
3. Strong, unique passwords for every WordPress account. Minimum 16 characters, combining upper and lower case letters, numbers, and special characters. Never share passwords between different systems.
4. Limit the number of login attempts. WordPress does not limit login attempts by default - this needs to be addressed either at the server level, via .htaccess, or with an extension protecting the login form.
5. Set wp-config.php permissions to 400 or 440. The default permission 644 leaves the file readable by everyone - including a potential attacker with access to the file system. The file contains database login credentials.
6. Correct file and directory permissions. Files: 644. Directories: 755. Never 777 in production - this setting allows everyone to write.
7. SSL and HTTPS everywhere, certificate with automatic renewal. In 2026, HTTPS is an absolute baseline. Verify that the redirect from http:// to https:// works and the certificate renews automatically before expiry.
8. Off-server backups, every day. A backup on the same server won't help if the server is compromised. Backups belong in external cloud storage. For active business sites we recommend daily database backups and weekly full-site backups.
9. Minimise the number of plugins. Every plugin is a potential attack vector. Delete all plugins you are not actively using - even a deactivated plugin leaves files on disk. Before installing a new one, check the date of the last update (ideally no older than 6 months) and the number of active installations.
10. Monitoring and alerts for security events. Set up alerts for new logins from unknown devices, file changes, and site downtime. The sooner you catch an anomaly, the less damage it causes.

Automatic updates: when they are safe and when testing is needed

WordPress.org clearly recommends enabling automatic updates for core security patches. For plugins the situation is slightly more complex - minor versions (security patches and bug fixes) are usually safe to automate, major versions (a jump from for example 3.x to 4.x) can bring incompatibilities. For WordPress 7.0 and later versions we recommend keeping PHP up to date as well - we covered what WordPress 7.0 brought and why PHP version matters in the article WordPress 7.0: what's new and why it's AI-friendly.

Update type	Benefits	Risks	Recommendation
WordPress core - minor	Immediate security patch	Minimal	Always automatic
Plugins - minor/patch	Fast protection against active exploits	Rare incompatibility	Automatic for most
Plugins - major version	New features, long-term support	Possible theme incompatibility	Manual after testing
No updates	-	Critical security risk	Never

If you don't have a staging environment for testing before major updates, setting one up is among the fastest-return investments - far cheaper than fixing a site after an update that broke production.

Plugins and themes: where 91% of vulnerabilities hide

WordPress core is relatively secure - the problem is the extended ecosystem of plugins and themes. This number deserves repeating: 91% of all recorded WordPress vulnerabilities in 2025 came from plugins and themes. And 46% of them had no patch at the time security researchers publicly disclosed the vulnerability.

What this means in practice:

• A plugin from an unknown developer with its last update a year ago is an active security risk - regardless of how good it looks.
• A deactivated plugin still poses a threat - files are on disk and an attacker can exploit them.
• Premium plugins from marketplaces (e.g. Envato) had a significantly higher share of high-severity vulnerabilities in 2025 than freely available plugins from wordpress.org.

For sites undergoing migration - such as when moving from Elementor to a clean WordPress theme - a plugin audit is a mandatory part of the process. Every plugin that doesn't carry over to the new theme is an opportunity to reduce the attack surface.

In practice: what we see with managed sites

Most security incidents on typical business WordPress sites are predictable, and predictable problems are preventable. At sites where we provide monthly support and care, we repeatedly encounter the same weaknesses:

• Plugin without an update for 18 months - the developer stopped maintaining the project
• Production admin account without two-factor authentication
• Backups stored on the same server where the site runs
• wp-config.php with default permissions 644
• WordPress on version 6.x without automatic security updates enabled

On sites where these basics are working, the chance of a successful automated attack is significantly lower. Bots look for easy targets - a site with active defences will be skipped.

Security is also linked to the health of the site as a whole. Outdated plugins, old design, and slow loading times are also signals that it's time for a site redesign. Technical debt grows quietly; a security incident will visibly accelerate it.

WordPress site security is not about installing one extension. It is a series of settings and routines - updates, 2FA, backups, permissions, monitoring. Each layer reduces the probability of a successful attack and shortens recovery time if one does occur.

Want someone else to handle the security and updates of your WordPress site? Support and care from Denva includes regular updates, off-server backups, and monitoring. Free consultation - we respond within 24 hours.

FAQ

Frequently asked questions.

What should I do first when I discover my WordPress site has been hacked?

Isolate the site immediately - temporarily take it offline or restrict access. Then restore a backup from before the attack, change all passwords and database credentials, and review the logs to understand how the breach happened.

Is a security plugin enough to protect a WordPress site?

A plugin helps, but it is not sufficient on its own. It must complement strong passwords, two-factor authentication, regular updates, and backups - not replace them. Layered protection is the foundation.

How often should I back up a WordPress site?

For active business sites we recommend daily database backups and weekly full-site backups, always stored in external cloud storage separate from the server where the site runs.

Is it safe to use free WordPress plugins?

Yes, if they are actively maintained. Before installation, check the date of the last update (ideally no older than 6 months), the number of active installations, and user ratings.

Is it necessary to change the default wp-admin URL?

It helps reduce the volume of brute-force attempts, but it cannot replace two-factor authentication. Consider changing the default URL as a supplementary layer, not primary protection - start with 2FA and updates.