WordPress security hardening: the no-fluff 2026 guide
Quick answer
WordPress security hardening in 2026 comes down to a few high-impact controls: two-factor on every admin, a real WAF in front of the site, file permissions locked down, automatic updates for security releases, and database backups that are restored and tested monthly. Most breaches we clean up would have been blocked by these five things alone.
The five controls that stop most attacks
Two-factor authentication on every administrator and editor account. Not optional in 2026.
A real web application firewall in front of WordPress (Cloudflare WAF, Wordfence Premium, or Sucuri).
Strict file permissions: 644 on files, 755 on folders, wp-config.php at 600, no writable theme files in production.
Automatic security updates for WordPress core, and a tested process for plugin updates.
Offsite, encrypted, restored-and-tested backups. Daily for content sites, hourly for ecommerce.
Headers and policies worth setting
Strict-Transport-Security with a long max-age and includeSubDomains.
Content-Security-Policy at least in report-only to learn what your site loads, then enforce.
Referrer-Policy strict-origin-when-cross-origin.
X-Frame-Options DENY or a frame-ancestors CSP directive to block clickjacking.
Things people obsess over that do not matter much
Hiding the WP-version in the head. Attackers fingerprint by behaviour, not by meta tags.
Renaming wp-login.php. Helpful against the dumbest bots, useless against a targeted attack.
Changing the database table prefix on an existing site. Risky for marginal benefit.
What we do when a site is breached
Take a forensic snapshot first so we know what changed.
Rotate every credential: WordPress admins, database, hosting, SFTP, API keys.
Reinstall core, themes, and plugins from clean sources. Never trust a file already on the server.
Scan for backdoors in uploads, mu-plugins, and outside the WordPress install.
Request reconsideration in Google Search Console if the site was flagged.
Common questions
Is a security plugin enough?+
It is one layer. A real WAF in front of the site plus 2FA plus tested backups beats any single plugin.
How often should I rotate WordPress admin passwords?+
Quarterly for normal sites. Immediately if anyone with access leaves the team or any device is lost.
Want help with this?
The pages below go deeper, by service and by city.
Want this handled for you?
Book a call and we will review your site before recommending anything.