Recommended Free Tools
The most important WordPress security work in 2026 is operational, not cosmetic: run a supported software stack, enforce HTTPS and least-privilege access, remove unnecessary code, keep independent tested backups, and monitor the site continuously. Complete the pre-launch controls first, then use the weekly and periodic routines below to keep the protection effective.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
What a secure WordPress site requires in 2026
WordPress powers more than 43% of the web, so it is a frequent target and a valuable security target for attackers. The project’s security page says its security work is supported by more than 50 trusted experts. That scale makes prompt maintenance important: a vulnerability fixed in a new release can become easier to exploit after technical details enter the public domain.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →WordPress officially supports only the latest core release. The Security Team may backport critical fixes to older versions as a courtesy, but that is not a substitute for staying current. For example, WordPress 7.0.2 was released on July 17, 2026 with security fixes. Treat a security release as an immediate maintenance task rather than something to defer to a convenient redesign.
| Security area | Minimum action | What it protects |
|---|---|---|
| Software support | Update WordPress core, plugins, themes, PHP and the database to supported releases | Known vulnerabilities and exploitable bugs |
| Transport security | Use HTTPS for every page, login and administrative path | Credentials, sessions and data in transit |
| Access control | Named accounts, unique passwords, multi-factor authentication where available, and least-privilege roles | Administrator takeover and abuse of excess permissions |
| Attack surface | Remove unused plugins and themes; install extensions only from trusted sources | Vulnerable or abandoned code |
| Recovery | Keep complete, independent backups and rehearse restoration | Ransomware, defacement, deletion and failed updates |
| Detection | Review logs, alerts, vulnerabilities and update notices | Early discovery of compromise or unsafe software |
Start with a supported hosting stack
Use the current WordPress core release
Enable automatic security updates when your hosting and change-control process allow them, and review every core update afterward. Automatic updates reduce the window in which a public vulnerability can be used, but they do not remove the need to update plugins, themes, PHP or the database. Keep a recent backup before substantial changes and know how to restore it.
#1 Best Overall
Meet the PHP and database baseline
WordPress.org’s current requirements specify PHP 8.3 or greater, MariaDB 10.11 or greater or MySQL 8.0 or greater, and HTTPS for every installation. PHP 7.4 and MySQL 5.5.5 are end-of-life; leaving a site on either version can expose it to unpatched vulnerabilities and may prevent newer WordPress releases or extensions from working correctly.
Check the actual versions in your hosting control panel or ask the host for confirmation. Test a PHP or database upgrade on a staging copy when possible. Review themes and plugins for compatibility before switching versions, and schedule the change with a rollback plan rather than relying on an untested production upgrade.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRequire HTTPS everywhere
Install a valid certificate and force HTTPS at the hosting layer. Confirm that the public site, login screen, password-reset links, XML-RPC endpoint if enabled, REST requests and every administrative URL use HTTPS without mixed-content warnings. Update the WordPress and site URLs to the HTTPS addresses and redirect HTTP requests only after verifying that the certificate covers every hostname visitors use.
Harden a new site before launch
- Choose a host that meets the baseline. Confirm PHP 8.3+, MariaDB 10.11+ or MySQL 8.0+, HTTPS support, routine patching and a way to obtain logs and backups.
- Install from the official source. Obtain WordPress core from WordPress.org or through a host’s verified installer. Do not use altered packages or extensions from an unknown download site.
- Delete unused software. Remove inactive plugins and themes rather than merely disabling them. Every retained component can become vulnerable, and abandoned code may not receive a fix.
- Create named accounts. Give each person an individual account; never share the administrator login. Use a strong, unique password stored in a reputable password manager.
- Assign the smallest role that works. Authors, editors, administrators and custom roles should receive only the capabilities their jobs require. Remove accounts when people leave or no longer need access.
- Protect configuration and administration. Restrict access to
wp-config.php, use secure file permissions supplied by the host, and disable unnecessary administrative features such as in-dashboard file editing. - Configure backups before publishing. Capture the database and complete WordPress files, store copies independently from the host, and verify that a restore is possible.
- Turn on monitoring. Establish a place to review login events, file changes, update failures and security alerts before traffic arrives.
Control accounts, authentication and privileges
Use unique credentials and multi-factor authentication
Use a different password for every WordPress and hosting account. Protect the hosting control panel, database account, domain registrar and email used for password recovery as carefully as the WordPress administrator account. Enable multi-factor authentication for administrator and hosting access when the service supports it. If an account is suspected of compromise, change its password, revoke active sessions and inspect other accounts that could have been reached through password reuse.
Limit administrator exposure
Keep administrator access for people who perform administrative work. Editors can publish and manage content without receiving every configuration capability. Review users and roles on a schedule, especially after a contractor, agency or employee finishes work. Remove dormant accounts instead of leaving them available for credential stuffing.
Protect the login path without locking out legitimate users
Rate-limit repeated login attempts and monitor failed-login spikes. A firewall or security service can help absorb automated attempts, but blocking an IP address alone is not a complete defense because attackers rotate addresses. Keep an emergency administrator recovery method documented and test it before tightening restrictions.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Reduce plugin, theme and file risk
Install only maintained extensions from trusted sources
Review the developer, release history, compatibility information and support status before installing a plugin or theme. Apply security updates promptly and remove components that are no longer maintained. A plugin that is disabled but left installed still represents code that could be activated or exploited through a vulnerability, so delete it when it is not needed.
Separate staging from production
Test major updates on a staging copy that is access-controlled and excluded from search indexing. Use production-like PHP and database versions, then check forms, ecommerce flows, authentication and integrations before deploying. Never copy real customer data into staging without a documented reason and appropriate protection.
Restrict file changes
Use the least-permissive file and directory permissions that your host supports. The web process should not have broad write access to the entire installation. Protect configuration files from web access, prevent directory listing, and disable the built-in editor for plugin and theme files when administrators do not need it. These measures limit the damage from a compromised account and make unexpected file changes easier to identify.
Review database privileges
Use a dedicated database user for the site with only the privileges WordPress needs. Do not reuse a powerful database administrator account for routine web requests. Keep database credentials out of public repositories and rotate them when staff or hosting arrangements change.
Make backups useful after a hack
Back up the complete installation
A WordPress recovery set needs both the database and the files: core files, wp-content, uploaded media, themes, plugins and configuration needed to rebuild the site. A database-only export cannot restore uploaded images or code; files without the database cannot restore posts, settings or users.
Keep independent, protected copies
Store at least one copy outside the production host and maintain an offline-capable copy that an attacker cannot alter through the website account. Protect backup access with separate credentials and multi-factor authentication. Retain enough historical versions to predate the compromise; a backup created after malware was introduced may faithfully preserve the problem.
Rehearse restoration
WordPress guidance on brute-force attacks specifically calls for tested, offline-capable backups and rehearsed restore procedures. Periodically restore to an isolated environment, confirm that the database and files match, check media and user logins, and record the time and steps required. A backup is a recovery control only when the team can retrieve it and produce a working site.
Recovery sequence after suspected compromise
- Record what was observed, including timestamps, affected accounts, URLs and alerts.
- Contain the incident by restricting administrative access and isolating the site or affected hosting account when necessary.
- Preserve logs and a copy of the compromised state for investigation; do not overwrite evidence with repeated reinstalls.
- Reset WordPress, hosting, database, domain and recovery-email credentials from a clean device, and revoke sessions and application tokens.
- Identify and remove malicious files, unauthorized users, altered settings and vulnerable extensions. Update the entire stack before reopening access.
- Restore a known-clean backup when cleaning cannot establish trust, then patch the weakness that allowed entry.
- Monitor closely after restoration and document the cause, actions and follow-up controls.
Detect problems before visitors report them
Collect and review useful signals
Enable hosting and web-server logs, WordPress activity records where appropriate, backup reports and security alerts. Review failed logins, new administrator accounts, unexpected plugin or theme changes, modified core files, unusual outbound email, sudden traffic changes and repeated 404 requests for sensitive paths. Keep clocks synchronized so events from the host, firewall and WordPress can be compared.
Track vulnerabilities and maintenance notices
Assign someone to review WordPress core, plugin and theme update notices at every maintenance window. Confirm that active extensions are still maintained and that security fixes actually completed. An update dashboard that reports success is useful, but verify the running version and test critical site functions afterward.
Write an incident plan
Document who can disable access, contact the host, retrieve backups, reset credentials and communicate with customers. Include emergency contacts, the location of logs and backups, the restore sequence and the criteria for bringing the site back online. Practice the plan so an incident does not become a search for undocumented credentials.
Use a maintenance schedule that people can follow
Every week or maintenance window
- Review WordPress core, plugin and theme updates, prioritizing security releases.
- Check that backups completed and that the latest copy is readable.
- Inspect login, file-change and hosting alerts.
- Confirm that active extensions remain supported and necessary.
- Review newly created users, privilege changes and administrator activity.
At least periodically
- Perform a full restore rehearsal in an isolated environment.
- Audit users, roles, database privileges and hosting accounts.
- Verify HTTPS on login, administration, redirects and integrations.
- Check PHP, MariaDB or MySQL versions against the current WordPress requirements.
- Review file permissions, configuration protection and disabled file editing.
- Refresh the incident-response plan and contact list.
Choose controls that fit the site’s risk
| Site situation | Priority controls | Operational trade-off |
|---|---|---|
| Small brochure site with one administrator | Supported stack, HTTPS, unique credentials, MFA, minimal extensions, independent backups and basic alerts | Low maintenance burden, but the owner must still test restoration |
| Content team with several editors | Named accounts, role review, MFA, activity logging, staging and update procedures | More administration, substantially less risk from shared credentials |
| Store or membership site | All baseline controls plus stronger monitoring, rapid patching, tested rollback and an incident contact | More testing is required because downtime and data exposure have greater impact |
| High-traffic or regulated site | Managed operations, centralized logs, documented response ownership, isolated backups and regular recovery exercises | Higher ongoing cost and process overhead, appropriate for higher consequences |
A security plugin, managed host or firewall can consolidate some of these controls, but none replaces supported versions, careful permissions, independent backups or a practiced response. Select services according to the prevention, detection and recovery gaps your team can actually maintain.
Quick Recap
Final launch checklist
- WordPress core is current and security updates are enabled or assigned to a responsible person.
- PHP is 8.3 or newer; the database is MariaDB 10.11+ or MySQL 8.0+.
- HTTPS works across the public site, login and administration.
- Every user has an individual account, a unique password and the minimum required role.
- Administrator and hosting access use multi-factor authentication where available.
- Unused plugins and themes are deleted; active extensions come from trusted, maintained sources.
wp-config.php, database credentials and file permissions are protected.- Dashboard file editing and other unnecessary features are disabled.
- Complete database-and-file backups exist outside the production host.
- A restore rehearsal has succeeded and the recovery procedure is written down.
- Logs, update notices, backup reports and security alerts have an owner.
- The incident plan includes containment, credential resets, clean restoration and post-incident monitoring.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
