WordPress security: a checklist that closes most hacks

Published 2026-11-03 · 6 min read · By the Alian Digital team

Most WordPress hacks are not genius hackers but an outdated plugin, a weak password or an open admin. Here is what closes the main holes.

1. Updates

Update core, themes and plugins on time, on a copy first if the site is critical. Outdated plugins are the most common way in for attackers.

2. Remove the unnecessary

Delete plugins and themes you do not use, even disabled ones. Each component is extra risk and load.

3. Passwords and two-factor authentication

• Unique long passwords for every administrator.
• Two-factor authentication for everyone with admin access.
• Do not use the username admin; do not leave accounts of former employees.

4. Login limits

Limit the number of login attempts and, if needed, change the login page address. That reduces password guessing.

5. Files and settings

• Minimal permissions on files and directories.
• Disable the file editor in the admin (the DISALLOW_FILE_EDIT constant).
• Block access to wp-config.php and service files.
• Use a current, supported PHP version.

6. Backups

Automatic copies following the 3-2-1 rule and restore testing: your last line if protection fails.

7. Firewall and monitoring

A site- or host-level firewall, file change scanning and alerts on unusual activity let you notice a problem in hours instead of months.