Securing WordPress in 2026: A Hardening Guide

Securing WordPress in 2026 means keeping the core, extensions, and PHP up to date, enabling two-factor authentication, minimizing the number of plugins, protecting the admin panel, and monitoring alerts. The risk rarely comes from a “genius hacker”; it mostly stems from a known vulnerability, a guessed password, or an abandoned extension. A realistic budget in France ranges from €600 to €2,500 for serious hardening and a hors overhaul.

Securing WordPress: What's Really Changing in 2026

WordPress remains a good choice for a small or medium-sized business, provided it is treated as a business asset, not just an online brochure. A WordPress site often contains forms, customer accounts, payments, SEO content, and sometimes personal data. A security breach therefore costs more than just a defaced page.

As of July 2026, WordPress 7.0.2 is the current security release, addressing one critical vulnerability and one high-severity vulnerability, identified as CVE-2026-60137 and CVE-2026-63030. Updated versions have also been released for earlier branches, such as WordPress 6.9.5 and 6.8.6. The message is simple: staying on an old version is no longer a reasonable option.

The official WordPress documentation notes that older versions no longer receive security patches on an ongoing basis. It also specifies that automatic background updates have been available since WordPress 3.7 for minor and security updates. In other words, if your site blocks these mechanisms without a documented reason, you assume the risk.

The pitfall that non-technical users underestimate: an automatic update is not a comprehensive security strategy. It reduces the exposure window, but it is no substitute for tested backups, monitoring, or plugin audits. A website can be “up to date” and still be vulnerable due to a shared administrator account or a misconfigured form plugin.

Is WordPress secure by default? Yes, but not on its own

The core of WordPress is maintained by a highly organized community. WordPress.org documents two common types of attacks: requests that exploit known vulnerabilities—often in outdated extensions or software—and brute-force attacks, which involve massive attempts to guess passwords. It’s less dramatic than a movie, but much more common.

The volume to monitor is considerable. WordPress.org reports hosting approximately 78,000 plugins and themes, and the “Protect The Shire” initiative announced in 2026 is specifically aimed at securing this ecosystem. A 24-hour delay before new versions of plugins and themes are automatically released has been introduced to limit certain exploit effects. It’s a good measure, but not an absolute guarantee.

Wordfence reported in its 2024 annual report more than 3,427 WordPress vulnerabilities, based on over 5,100 reports received. This figure does not mean that WordPress is “dangerous” by nature; rather, it shows that the ecosystem is vast and closely monitored, and that vulnerabilities are often concentrated in third-party components.

In the projects we work on, we often see the same trade-off: a free plugin installed to save two hours ends up costing a full day of work when it’s no longer maintained. Given that budget, it’s sometimes better to develop a small feature from scratch or choose a paid extension that’s actively maintained, with a clear update history.

The 15-Point Hardening Checklist

Hardening involves reducing the attack surface—that is, everything an attacker might try to exploit. It does not make a site invincible. It makes attacks more difficult, more visible, and less costly to address.

1. Update WordPress, the themes, and the plugins, and verify that WordPress 7.0.2 or an equivalent corrigée branch is installed.
2. Use a version of PHP maintained by your hosting provider, since PHP is the server-side engine that runs WordPress.
3. Enable automatic security updates, unless there is a documented business requirement to the contrary.
4. Delete unused plugins and themes—don't just deactivate them.
5. Choose plugins that are actively maintained, compatible with the version of WordPress you are using, and have been updated recently.
6. Require long, unique passwords managed by coffre-fort.
7. Enable two-factor authentication (2FA) for all administrator accounts.
8. Limit administrator accounts to only what is strictly necessary, and create editor or contributor roles when that is sufficient.
9. Restrict access to wp-admin, the administration area, using an application firewall or IP rules when appropriate.
10. Protect wp-config.php, the file that contains sensitive database connection settings.
11. Disable file editing from the WordPress interface to prevent a compromised account from directly modifying the code.
12. Use HTTPS with a valid TLS certificate and consider HSTS, the HTTP header that instructs the browser to use only HTTPS.
13. Add appropriate security headers, such as Content-Security-Policy to control authorized sources, and X-Frame-Options or frame-ancestors to restrict display within an iframe.
14. Set up automatic, off-site backups and test restores at least once a quarter.
15. Centralize logs, alerts, and monitoring to quickly detect suspicious connections, modified files, and server errors.

The often-overlooked step is the restore test. A backup that’s never been restored is a promise, not a guarantee. For a showcase site With a few For forms, a quarterly test is often sufficient; for a WooCommerce site or a customer portal, you'll need to increase the frequency.

If your website collects personal data, the RGPD also requires a proactive approach to security. For certain organizations subject to the European NIS2 Directive, which has been applicable in member states since October 2024, cybersecurity governance is becoming more complex; this topic is discussed in detail in our analysis on NIS2 requirements as applied to WordPress.

Which security plugins should you choose without slowing down your website?

A security plugin isn't a magical corps guardian. It's a tool. It can filter attacks, scan files, log events, and add 2FA, but it also adds code, settings, and sometimes server load.

Wordfence Security, version 8.2.2 released on May 13, 2026, claims to have over 5 million active installations and has been tested for compatibility with WordPress 7.0.2 and PHP 7.0+. It includes a WAF (Web Application Firewall) that filters certain requests, a malware scanner, 2FA, real-time traffic monitoring, and alerts. The full audit log is available in the paid plan.

The Two Factor plugin, version 0.16.0 released on March 27, 2026, has a more focused user base: over 100,000 active installations, requires WordPress 6.8+ and PHP 7.2+, with support for TOTP, email, backup codes, and WebAuthn/passkeys via an extension. If your primary need is forte authentication, this is often a lighter solution than a full-featured suite.

Honestly, installing three security plugins at the same time is rarely a good idea. They can interfere with each other, slow down the site, and generate conflicting alerts. It’s better to have a straightforward setup: a network-side or hosting-provider firewall, a properly configured WordPress tool, and clear procedures.

For sensitive access points, the passkeys are also worth exploring: they replace the password with a cryptographic key linked to the device or identity manager. The principle is explained in our feature on The use of passkeys on a website, which is useful if you manage customer accounts or an extranet.

Hosting, Cloudflare, Backups: The Invisible Foundation

A secure WordPress installation on a poorly configured hosting server remains vulnerable. The hosting provider must provide supported PHP versions, backups, SFTP access instead of FTP, TLS certificates, and strict isolation between sites. At OVHcloud, o2switch, Infomaniak, or with a managed WordPress hosting provider, the offerings vary significantly in these areas.

Cloudflare can add a useful layer of protection: traffic filtering, WAF rules, rate limiting, caching, and DNS protection. It’s not a replacement for application security, but it’s a good amortisseur. For a site under a brute-force attack on /wp-login.php, limiting attempts at the Cloudflare level is often a cleaner solution than letting PHP handle every request.

HTTP headers require careful configuration. HSTS forces the browser to stay on HTTPS. Content-Security-Policy can block unauthenticated scripts, but a policy that’s too strict can sometimes break marketing tools, maps, or video players. X-Frame-Options limits the embedding of the site within a frame, while CSP frame-ancestors provides more comprehensive control.

A budget tip: For a small website, security is less expensive when it’s planned as part of a redesign. If you’re redesigning your site, be sure to include migrations, redirects, backups, and SEO checks in the same package; our checklist of Redesign of WordPress without losing search engine rankings provides useful guidance.

Timelines, Risks, and Trade-offs for a Executive

For a standard showcase site, a thorough hardening process typically takes two to five business days: quick audit, updates, removal of unnecessary components, 2FA, backups, firewall rules, restore testing, and documentation. For a WooCommerce site or a logged-in area, allow one to three weeks, as critical user flows must be tested.

The cost depends less on the number of pages than on the technical condition of the site. A recent site with few extensions can be secured quickly. A six-year-old WordPress site with an unmaintained theme, ten page builders, and modifications made directly to the parent theme often requires a cleanup before security can even be addressed.

The scenario where the obvious solution is the wrong one: updating everything at once in production, without a restorable backup or a test environment. This can trigger errors, which may then break the order tunnel or the quote request form. From the agency’s perspective, the best practice is to proceed as follows: back up, clone, update, test, and then deploy in stages.

Also consider security as an organizational issue. Who receives alerts? Who approves a sensitive update? Who deactivates an account for an employee who has left the company? For a website that handles personal data, these questions also align with GDPR best practices; common mistakes regarding privacy notices and consent forms are addressed in our guide on Common Pitfalls of GDPR Cookies.

Defining the scope of this type of project early on helps avoid most unpleasant surprises: inventory, data criticality, expected service level, maintenance budget, and incident procedures. This is often where an outside perspective can save time, especially when the site is already generating business inquiries or sales.

FAQ on WordPress Security in 2026

How can I tell if my WordPress is vulnerable?

Start with the site’s Health screen: it flags disabled updates, failed background updates, outdated PHP versions, and pending extensions. Also check the WordPress version, deprecated plugins, and administrator accounts.

Should you hide the wp-admin URL to secure WordPress?

Hiding wp-admin can reduce bot activity, but it isn't a real security measure on its own. Two-factor authentication (2FA), limiting login attempts, unique passwords, and keeping your software up to date are much more important.

How much does it cost to secure a WordPress site?

In France, expect to pay between €600 and €2,500 for a thorough security hardening of a showcase website or an SME site, depending on its initial condition. A more comprehensive audit, including corrections for WooCommerce or the customer portal, can cost between €1,800 and €5,000.

Is a plugin like Wordfence enough?

No, it helps a lot if it's set up properly, but it doesn't replace backups, updating PHP, removing unnecessary plugins, and monitoring. WordPress security is a chain of measures, not just a single tool.

How often should WordPress updates be performed?

Security patches should be applied as soon as possible, ideally through automatic updates for minor versions. For sensitive extensions, a weekly review is a good schedule for a professional website.