How to Secure a WordPress Site: 15 Steps for Small Businesses (2026)

Updated October 2026

WordPress itself is well maintained. The risk is almost everything around it. Patchstack’s State of WordPress Security in 2026 report counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, up 42% on the year before, and 91% of them were in plugins (most of the rest were in themes). Many had no fix available when they were made public, and attackers often start exploiting popular plugins within hours.

The good news: a handful of habits blocks most attacks. Here are fifteen steps, in order of impact.

Keep everything updated

1. Turn on automatic updates for WordPress core, and for plugins and themes from developers you trust.
2. Use a supported PHP version. Your host can tell you which one you’re on.
3. Delete what you don’t use. Deactivated plugins and old themes can still be attacked. Remove them.

Fewer, better plugins

4. Keep your plugin list short. Every plugin adds risk. Ask whether each one is really needed.
5. Only install from trusted sources: the WordPress.org directory or the developer’s own site. Never use "nulled" (pirated) premium plugins; they often contain malware.
6. Check before you install: recent updates, active installations and good support.
7. Get vulnerability alerts. Security services such as Wordfence and Patchstack warn you when a plugin on your site has a known problem.

Lock down logins

8. Use strong, unique passwords with a password manager.
9. Turn on two-factor authentication for every administrator.
10. Limit administrator accounts. Give staff the lowest role they need, and remove accounts for people who’ve left.
11. Limit login attempts, and avoid obvious usernames such as "admin".

Prepare for the worst

12. Back up automatically, daily if you change content often, and keep copies somewhere other than your web server.
13. Test a restore at least once, so you know your backups work.

Add layers of protection

14. Use a web application firewall, from your host, a service such as Cloudflare, or a security plugin, to block attacks before they reach WordPress.
15. Harden the basics: use HTTPS everywhere, and turn off the built-in file editor by adding define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php.

If your site is hacked

1. Stay calm and take the site offline or into maintenance mode if it’s sending visitors to harmful pages.
2. Change every password: WordPress, hosting, database and email.
3. Restore a clean backup from before the attack, then update everything immediately.
4. Scan for leftover malware, or ask your host or a security service to clean the site.
5. Find the cause, usually an outdated plugin, and fix it so it doesn’t happen again.
6. Check Google Search Console for security warnings, and request a review once the site is clean.

Is WordPress the right fit for you?

If nobody has time to look after a WordPress site, a simpler platform may be safer. See our guide to WordPress alternatives, or build a fast, static business website with nothing to update using our free website builder.

Related guides

• How to Disable Theme Editor and Plugin Editor in WordPress
• Complete Instructions on How to Convert PDF to Word on Mac easily
• WordPress Tutorials
• Best Ways to Secure Shared Web Hosting Account, Best Shared Web Hosting
• Best WordPress Blogger Themes for creating a personal blog
• Create Sitemap in WordPress
• How to a Install WordPress Theme Easily
• Best WordPress Hosting for Small Businesses in 2026: Prices, Renewals and How to Choose
• Guide to Migrate WordPress

Sources

1. Patchstack, State of WordPress Security in 2026
2. WordPress.org, Hardening WordPress

Last reviewed October 24, 2026. Startup costs are estimates; check local prices, licensing and tax rules before you commit money.