WordPress website security is a priority many site owners overlook until an attack actually happens. One plugin you forgot to update can be enough to let an attacker in, and the damage can range from leaked customer data to a damaged business reputation. This article is a complete guide to securing your WordPress website effectively against hackers.
Key points in this article
- Many successful WordPress attacks exploit outdated plugins or themes and weak passwords, both of which are easy to prevent
- A WordPress site that has not been updated in 6 months is an easy target, so updating core, plugins and themes is your first line of defence
- Two-factor authentication (2FA) on wp-admin means a leaked password alone is not enough to log in
- Daily automatic backups to external cloud storage are the most important ‘insurance’ a business website can have
- A WAF firewall (such as Cloudflare or Wordfence) can block many attacks before they reach your server
- 15 Best WordPress Plugins for Business Websites in 2026
- How to Build a WordPress Website from Scratch: A Complete Tutorial
- On-Page SEO Techniques That Still Work in 2026
Why WordPress security matters more than ever in 2026
WordPress powers more than 43% of all websites on the internet, and that popularity is exactly what makes it a prime target for hackers. Experienced hackers are only part of the problem: automated bots scan thousands of websites every minute looking for unpatched security holes. The consequences are real: a hacked website can suffer malware injection, theft of customer data, SEO spam, and even a Google blacklisting that wipes out your organic traffic.
The good news is that most attacks can be prevented with a systematic approach to security. You do not need advanced technical skills. You need to apply the best practices in this guide consistently.
1. Use secure WordPress hosting
Security starts with the foundation, which is your choice of hosting. Hosting providers differ a great deal when it comes to security. Hostinger is a good choice for WordPress because it comes with layered security protection: an AI-based firewall, DDoS protection, automatic malware scanning and free SSL on every plan.
The Hostinger Business plan (from Rp 39,900/month) offers enterprise-grade security features such as account isolation (your account is not affected if another website on the same server is attacked), automatic daily backups and a Web Application Firewall (WAF) that filters out malicious traffic before it reaches your website.
2. Update WordPress, themes and plugins regularly
Plugins or themes that have not been updated are one of the most common ways into a WordPress site. Every update contains security patches for holes that have been discovered, so putting updates off leaves the door open for hackers.
- Update WordPress core: Minor and security updates already install automatically by default. To have major versions update automatically too, go to Dashboard > Updates > Enable automatic updates for all new versions of WordPress
- Update plugins: Check and update them every week. Delete plugins you are not actively using, because inactive plugins can still be a security hole
- Update themes: Do not keep themes you are not using. Every theme is a potential security hole, even when it is inactive
- Use trusted plugins: Only install plugins from the official WordPress.org directory or from trusted developers with plenty of reviews and active updates
3. Strengthen WordPress login security
Brute-force attacks, which repeatedly try to log in with different password combinations, are the most common method used to break into WordPress. Here are a few ways to deal with them:
Use a strong, unique password
Your WordPress admin password should be at least 16 characters long and combine upper- and lower-case letters, numbers and symbols. Use a password manager such as Bitwarden or 1Password to generate and store strong passwords. Never reuse the same password on other services.
Turn on two-factor authentication (2FA)
2FA adds an extra layer of security: even if your password leaks, a hacker still cannot log in without the verification code from your phone. The WP 2FA or Google Authenticator for WordPress plugins let you set up 2FA in a few minutes.
Change the default login URL
The default WordPress login URL (yoursite.com/wp-admin or yoursite.com/wp-login.php) is known to everyone, bots included. Change it to a custom URL such as yoursite.com/portal-admin-rahasia with the WPS Hide Login plugin. This effectively stops most automated brute-force attacks.
Limit login attempts
The Limit Login Attempts Reloaded plugin automatically blocks an IP address after a number of failed login attempts. A good configuration: a maximum of 3 attempts before a 20-minute lockout, and a permanent block after 4 lockouts.
4. The best WordPress security plugins in 2026
A dedicated security plugin is the most efficient way to manage WordPress security comprehensively:
Wordfence Security (free/premium)
Wordfence is the most popular WordPress security plugin, with more than 5 million active installations. Its main features are a real-time web application firewall, a malware scanner, brute-force protection and traffic monitoring. The free version is enough for most websites; the premium version gives you real-time malware signature updates without the 30-day delay.
Sucuri Security (free/premium)
Sucuri offers malware scanning, Google blacklist monitoring and security notifications. Its premium version ($199/year) adds a cloud CDN/firewall that filters traffic before it reaches your server, which is very effective for high-traffic websites.
Solid Security Pro (formerly iThemes Security Pro)
More than 30 security features in a single plugin: 2FA, brute-force protection, file change detection, database backups and a central security dashboard. It is ideal for websites that need thorough security configuration without the technical complexity.
5. Automatic backups: your last safety net
Backups are the most important insurance a WordPress website can have. Even with every layer of security in place, the unexpected can still happen, from a hacker attack to a failed update, a plugin conflict or a server failure. Without a backup, all of your data could be lost for good.
The recommended backup strategy follows the 3-2-1 rule:
- 3 copies of your data: the original files + 2 backups
- 2 different media: for example, your hosting server + cloud storage (Google Drive/Dropbox)
- 1 offsite copy: at least 1 backup stored outside your main server
The best backup plugins for WordPress:
- UpdraftPlus: Scheduled backups to Google Drive, Dropbox or S3. The free version already covers the basic features you need
- BackWPup: A reliable free alternative with flexible scheduling options
- Hostinger Backup Manager: If you host with Hostinger, daily backups are available directly in hPanel with no extra plugin
Recommended backup frequency: daily for active websites with new transactions or content, weekly for static websites.
6. Install SSL and force HTTPS
SSL (Secure Sockets Layer) encrypts the data sent between your visitor's browser and your server, so login details, form data and transaction details cannot be intercepted. In 2026, browsers mark websites without SSL (HTTPS) as ‘Not Secure’, and those sites lose both visitor trust and Google rankings.
Free SSL is available on every Hostinger plan through Let’s Encrypt. Once SSL is active, force all traffic to HTTPS by adding the following code to your .htaccess file:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Alternatively, use the Really Simple SSL plugin, which automates the process without any manual file editing.
7. Secure your wp-config.php and .htaccess files
The wp-config.php file holds the most sensitive information in WordPress: database credentials, security keys and other critical configuration. It needs extra protection. Add the following code to .htaccess to block direct access:
<files wp-config.php>
order allow,deny
deny from all
</files>
<files .htaccess>
order allow,deny
deny from all
</files>An extra step: move wp-config.php one level above your public HTML directory (outside the public_html folder). WordPress will find it automatically in its new location.
8. Monitor and audit security regularly
Security is an ongoing process. A one-off configuration will not keep you safe. Schedule regular security audits:
- Weekly: Check the WordPress activity log (use the Activity Log plugin), update plugins and themes, and review active user accounts
- Monthly: Run a full malware scan, review file permissions (folders should be 755, files 644), and check whether the website is on Google's blacklist through Google Search Console
- Quarterly: Audit WordPress users (delete inactive accounts), change the admin password, and review your hosting server logs
9. Use an uncommon admin username
Automated hacking bots try ‘admin’, ‘administrator’ or the website's domain name as their first guesses. If you are still using the username ‘admin’, change it now:
- Create a new administrator account with a unique username (not your name or your domain)
- Move all content (posts, pages) to the new account
- Delete the old ‘admin’ account
10. Disable XML-RPC if you do not need it
XML-RPC is a WordPress feature that allows connections from external applications. It is also a popular route for brute-force attacks, because it can be used to try thousands of password combinations in a single request. If you do not use Jetpack or the WordPress mobile app, disable XML-RPC:
Add this to .htaccess:
# Block WordPress xmlrpc.php requests
<Files xmlrpc.php>
order deny,allow
deny from all
</Files>WordPress security checklist for 2026
Use this checklist to make sure your WordPress website is comprehensively protected:
- Trusted hosting with built-in security features (Hostinger Business/Cloud)
- WordPress core, themes and all plugins kept up to date
- A strong (16+ characters), unique admin password
- Two-factor authentication (2FA) turned on
- Login URL changed from the default /wp-admin
- Login attempts limited
- A security plugin (Wordfence/Sucuri) installed and active
- Automatic daily backups to cloud storage
- SSL active and HTTPS forced across the whole website
- wp-config.php and .htaccess protected
- XML-RPC disabled (if you do not use it)
- Admin username is not ‘admin’
- Security monitoring and regular audits scheduled
If setting all of this up feels like a lot, Webzoo offers a website maintenance service under a contract with a clear SLA. If you build a new website through Webzoo's website development service, every project also comes with a bug warranty after launch.
Secure your WordPress website today
Webzoo looks after WordPress websites under a maintenance contract with an SLA, so updates and security problems have someone clearly responsible for them.
Book a free website security consultation
