WordPress security is an ongoing operations task, not a single-plugin purchase. A defensible baseline combines current software, individual accounts with multifactor authentication, HTTPS, least privilege, tested off-site backups, layered filtering, monitoring, and a written recovery plan.
As of October 1, 2026, the latest release identified here is WordPress 7.0.2, announced as a security release on July 17, 2026; verify the live release information before updating: WordPress 7.0.2 release.
As an Amazon Associate I earn from qualifying purchases.
What WordPress security protects
Security protects more than the public homepage. It safeguards uptime, administrator accounts, customer and subscriber information, orders and payment-related data, search reputation, email deliverability, brand trust, backups, connected APIs, analytics, hosting access, and the ability to recover after an incident.
Free tools Windows power users keep installed
One-click scans. No signup required.
WordPress is only one part of the attack surface. Include the hosting panel, domain registrar, DNS provider, email accounts, PHP and database, themes and plugins, administrator devices, payment processors, marketing integrations, and third-party APIs in your security plan.
#1 Best Overall
How WordPress sites are attacked
Vulnerable plugins and themes
Outdated or poorly maintained third-party software can expose unauthenticated actions, privilege escalation, arbitrary uploads, SQL injection, cross-site scripting, remote code execution, authentication bypasses, or unsafe REST and AJAX handlers. Once a fix is published, technical details can make unpatched sites easier to target. Follow the official hardening guidance at WordPress hardening.
Stolen credentials
Brute-force guessing is only one route. Credential stuffing reuses passwords leaked elsewhere; phishing captures them directly; malware can steal browser sessions; and compromised email or hosting accounts can defeat otherwise good WordPress settings.
Supply-chain and abandoned software
Avoid nulled commercial packages, unofficial downloads, hidden backdoors, bundled obsolete libraries, and plugins or themes whose developers no longer provide security updates. Prefer the official WordPress directories or the vendor’s own distribution site.
Hosting and human failures
Weak control-panel credentials, outdated PHP, insecure FTP or SSH, permissive file ownership, shared-host contamination, and exposed databases are outside a plugin’s ability to fix. So are granting full administrator access to a contractor who only needs to edit content, installing an unverified “repair,” ignoring alerts, or restoring an infected backup.
Build the secure baseline
1. Inventory before changing settings
- Record WordPress, PHP, database, server, hosting, DNS, CDN and WAF versions or providers.
- List active and inactive plugins and themes, all users and roles, cron jobs, integrations, SSL status, backup locations and retention.
- Delete software that is not needed. Deactivation alone leaves files that may still be exposed.
2. Update safely
- Take and verify a complete database-and-files backup.
- Read release notes for major WordPress or high-risk plugin updates.
- Update staging first when practical.
- Apply security releases promptly.
- Check the homepage, login, forms, checkout, email and critical integrations.
- Review logs and alerts after the update and keep a rollback path.
WordPress has supported automatic updates since 3.7. They reduce delay but do not replace backups, compatibility checks or post-update testing. WordPress officially supports the latest version, while critical fixes may sometimes be backported to older versions as a courtesy: WordPress security.
3. Use supported infrastructure
The current WordPress requirements page recommends PHP 8.3 or newer, MariaDB 10.11 or newer or MySQL 8.0 or newer, and HTTPS, with Apache or Nginx as recommended servers: official requirements. Older versions may run, but PHP 7.4 and MySQL 5.5.5 are end-of-life and are not a recommended security baseline. Confirm operating-system, host and plugin compatibility before upgrading.
Protect accounts and logins
Use individual, least-privilege accounts
Never share an administrator login. Individual accounts provide accountability and make revocation straightforward. Use the lowest role that fits: Administrator for full management, Editor for site content, Author for personal posts, Contributor for writing without publishing, and Subscriber for basic account access. Agencies, WooCommerce and membership sites may need carefully designed custom roles.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Use unique passwords and MFA
Store unique passwords in a reputable password manager; do not reuse them across WordPress, hosting, email or your registrar. Remove dormant accounts and rotate credentials immediately after suspected compromise. WordPress core does not currently ship with built-in two-factor authentication, so use a maintained plugin or an identity provider. Prefer passkeys or hardware keys, then TOTP authenticator codes, then SSO with enforced MFA; SMS is a fallback rather than a first choice. The developer guidance describes passkeys and login defenses at brute-force protection.
Enable MFA for hosting, registrar, DNS or Cloudflare, email, backups, payment processing, your password manager and any connected WordPress.com account. Keep backup codes and a tested emergency recovery route.
Rate-limit without locking yourself out
Use edge or host WAF rate limits, login monitoring and MFA. Avoid treating a renamed login URL as primary protection. Aggressive limits or country blocks can affect offices, VPNs, schools, mobile carriers, crawlers and customers, so configure exemptions and test recovery.
Secure transport and configuration
Use HTTPS for public pages, /wp-admin/, login, checkout, forms, APIs and management interfaces. Check certificate validity, redirects, canonical URLs, mixed content and secure cookies. Enable HSTS only after every required subdomain works over HTTPS. HTTPS protects data in transit; it does not patch vulnerable code or stop a compromised account.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUseful configuration controls
To remove the dashboard’s built-in file editor, add:
define( 'DISALLOW_FILE_EDIT', true );You may force secure administration with:
define( 'FORCE_SSL_ADMIN', true );Test the second setting carefully behind a CDN or load balancer; incorrect proxy detection can create redirect loops.
Use the least-permissive file ownership and permissions that WordPress and deployment tools require. Protect wp-config.php from download and never expose database credentials, salts or API keys. Database privilege reductions such as removing DROP, ALTER or GRANT can break legitimate updates and plugins, so make changes only with a tested backup, staging site and rollback plan. Changing the default wp_ table prefix is a secondary measure, not a substitute for patching and prepared APIs. Details are in the hardening guide.
Do not blindly disable XML-RPC or the REST API. Determine whether Jetpack, remote publishing, the block editor, mobile apps, webhooks or headless integrations need them, then restrict only genuinely unused functions and test every dependent workflow.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallBackups that can actually restore the site
A usable backup contains the database, wp-content, uploads, plugins, themes, custom code, configuration needed to rebuild, and relevant commerce or membership data. Keep automated copies off the origin server, use separate credentials, encrypt where appropriate, retain copies long enough to cover the likely infection window, and protect high-value backups from deletion.
A practical starting point is daily database backups and daily or continuous file backups for active sites, with more frequent copies for stores, bookings and memberships. Adjust this to your recovery-point objective: how much recent work you can afford to lose.
Periodically restore to staging, a temporary host or a local environment. Confirm the site, admin, media, forms, orders, memberships, email and integrations work, and check for unexpected users or malware. Backups that omit the database or uploads, silently fail, expire credentials, sit on the compromised server, or contain the attacker are not recovery.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Choose the right security layers
WordPress security plugin
A plugin can provide an application firewall, malware scanning, file-integrity checks, login controls, MFA, alerts and audit logs. It runs close to the application, consumes resources and may not see traffic blocked upstream. A scan is evidence, not proof: novel, obfuscated, database-stored, server-level or credential-based compromises can be missed.
Edge WAF and host controls
An edge WAF filters traffic before it reaches the origin and can help with exploit patterns, reputation, rate limits, bots and some DDoS. It still needs correct DNS, proxy, caching exclusions and emergency bypasses. Cloudflare publishes plan details at cloudflare.com/plans; features vary by plan and configuration. Host controls may include isolation, managed updates, malware scanning, server backups and SSH protections—ask exactly what “managed WordPress” includes.
Tool choices by site
| Site | Starting setup | Key limitation |
|---|---|---|
| Personal blog | Updates, MFA, off-site backups, basic WAF or scanner | Owner must monitor and maintain it |
| Small business | Individual accounts, tested backups, vulnerability alerts, edge protection | A plugin is not managed incident response |
| WooCommerce or membership | Frequent backups, staging, payment-account MFA, transaction monitoring | Higher recovery and privacy obligations |
| Agency or multisite | Central management, standard configurations, isolation and disaster-recovery documentation | One compromised hosting account can affect many sites |
Wordfence Free includes firewall, scanning, login security and alerts, but its vendor states that free firewall rules and malware signatures are delayed 30 days; Premium supplies real-time rules and signatures: Wordfence plans. The vendor-listed Premium price seen here is $149 USD per year; Care is $590 per year and Response is $1,250 per year, all subject to change. Care and Response add vendor-described configuration, monitoring or incident-response services; verify scope and terms at the plan page. Jetpack Security advertises real-time backups, restores, WAF and scanning at $9.95 per month for the first year when billed yearly, with a stated regular price of $19.95; the promotion is first-year only: Jetpack Security.
Do not run overlapping firewalls and scanners without testing. Caching conflicts can break login, checkout, REST requests, webhooks or the block editor, while large scans can exhaust shared-hosting resources.
Maintenance schedule
- Daily or continuous: check backup success, uptime, critical alerts, suspicious logins and unexpected traffic or email.
- Weekly: review plugins, themes, users, security notices and staging updates.
- Monthly: test a restore or recovery step; remove unused accounts and software; verify hosting, DNS, registrar and backup access.
- Quarterly: exercise disaster recovery, review permissions, WAF rules, integrations and vendor maintenance status.
Signs your site may be compromised
Investigate unexplained administrator accounts, modified core files, redirects, injected SEO pages, spam mail, new scheduled tasks, unusual PHP errors, traffic or CPU spikes, failed or successful logins you do not recognize, DNS changes, search-engine warnings and recurring malware findings. No single clean scan proves the site is safe.
Recommended Free Tools
What to do after a hack
Incident response:
- Record symptoms and discovery time; preserve logs, alerts and forensic copies before deleting files.
- Put the site in maintenance mode or behind a holding page when appropriate and contact the host.
- From a known-clean device, change and revoke WordPress, hosting, database, SSH/SFTP, email, DNS, registrar, API, payment and application-password credentials and sessions.
- Check whether email, DNS, payment or other sites are also affected; notify people when legal or contractual duties require it.
- Build a fresh WordPress core installation, reinstall only trusted current plugins and themes, remove abandoned software, inspect the database and uploads, and restore only known-clean content.
- Patch, review ownership and permissions, reset every user credential, reopen cautiously and monitor closely.
Do not repeatedly reinstall plugins, overwrite evidence, or restore the newest backup without checking whether it predates the infection. Hire an incident-response professional when payment or sensitive data is involved, hosting access was compromised, malware returns, the root cause is unknown, multiple sites are affected, or legal, insurance, revenue or uptime consequences are substantial.
The Bottom Line
The minimum defensible baseline is current core and infrastructure, unique accounts with MFA, HTTPS, least privilege, trusted minimal software, tested off-site backups, layered WAF and monitoring, and a recovery plan you have practiced. Security services can reduce detection time or add expert response, but none replaces patching, careful access control and recoverable backups.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
