WordPress security hardening guide: what actually matters
Quick answer
WordPress security hardening in 2026 comes down to 10 controls in priority order: enforce 2FA on all admin accounts, put Cloudflare or a real WAF in front of the site, keep plugins/themes/core updated on a tested schedule, limit login attempts, disable file editing from the admin, use strong unique passwords via a manager, restrict xmlrpc.php and REST API user enumeration, run verified offsite backups, keep PHP and MySQL current, and monitor file integrity. The first four alone stop over 90% of real attacks.
Narrated evidence · engineer walkthrough
Tier 1: the 4 controls that stop 90% of attacks
1. 2FA on every admin account. WP 2FA plugin or the built-in Application Passwords with a hardware key. This alone stops the credential-stuffing attack that accounts for the majority of successful WordPress compromises.
2. Cloudflare (free plan is enough) or Wordfence Premium as a WAF in front of the site. Blocks the automated probes for known-CVE plugin vulnerabilities.
3. Tested weekly updates for plugins, themes, and core. Not auto-updates, tested. Auto-updates break sites, tested updates don't.
4. Limit Login Attempts Reloaded (or your host's rate limiter) on wp-login.php. Stops brute-force before it reaches WordPress.
Tier 2: the 4 controls that close the remaining gaps
5. Disable file editing from the admin: add 'define("DISALLOW_FILE_EDIT", true);' to wp-config.php. Stops a compromised admin from injecting PHP directly.
6. Strong unique passwords via 1Password/Bitwarden. Kill password reuse across the admin team. Enforce with a password policy plugin.
7. Restrict xmlrpc.php (block via .htaccess or nginx unless you specifically use Jetpack, the WordPress mobile app, or a legit remote publisher).
8. Restrict REST API user enumeration: block unauthenticated /wp-json/wp/v2/users. This is how attackers harvest usernames before credential stuffing.
Tier 3: the 2 controls that limit blast radius
9. Verified offsite backups. Not on the same host. Restored on staging monthly to prove they work. When (not if) the worst happens, this is the difference between a 2-hour rollback and a 2-week rebuild.
10. File integrity monitoring, Wordfence, Sucuri, or the host's built-in scanner. Detects the moment a PHP file changes so you catch a compromise in minutes rather than months.
Things people obsess over that don't matter much
Changing the wp-admin URL. Security theatre. Attackers scan for the login form directly, not the URL.
Hiding the WordPress version number. Attackers don't check the version, they probe the vulnerability regardless.
Renaming the wp_ table prefix on an existing site. Marginal benefit, real risk of breaking plugins. Skip on existing sites.
Blocking countries by IP. Legitimate visitors use VPNs; attackers use residential proxies. This blocks customers, not attackers.
Common questions
How do I harden a WordPress site?+
In priority order: enforce 2FA on all admin accounts, put a WAF (Cloudflare or Wordfence) in front of the site, keep plugins/themes/core updated weekly on a tested schedule, limit login attempts on wp-login.php, disable file editing from the admin, use strong unique passwords, restrict xmlrpc.php and REST API user enumeration, keep verified offsite backups, and monitor file integrity. The first four stop over 90% of attacks.
Is Wordfence enough to secure WordPress?+
Wordfence Premium covers WAF, malware scanning, login protection, and file integrity, which is 4 of the 10 controls. You still need 2FA, tested updates, verified offsite backups, and strong password enforcement. Wordfence is a good foundation, not a complete solution.
Should I move away from WordPress for security?+
Only if the flexibility WordPress gives you isn't worth the maintenance discipline it requires. WordPress with the 10 controls above is as secure as any managed CMS. WordPress with a random plugin stack and no maintenance is a ticking bomb. The platform isn't the issue; the discipline is.
Want help with this?
The pages below go deeper, by service and by city.
Want this handled for you?
Send the site and the symptom. A senior WordPress engineer opens it, tells you what is actually broken, and replies within one business hour. No card, no sales call, no obligation.