WordPress Security Hardening in 2026: The 12 Settings That Actually Matter

Most WordPress 'security' advice online is recycled from 2014. Here's the actual list of hardening steps that matter in 2026, based on what we see in real incident response.

The 12 settings

• Enforce 2FA on every admin account (no exceptions)
• Disable XML-RPC unless you specifically need it
• Move /wp-admin behind an IP allowlist or basic auth for staff-only sites
• Disable file editing in wp-config: define('DISALLOW_FILE_EDIT', true)
• Set strong file permissions: 644 for files, 755 for directories, 600 for wp-config.php
• Use a Web Application Firewall — Cloudflare, Sucuri or BunkerWeb
• Auto-update minor WordPress versions and all plugins
• Audit installed plugins quarterly — delete what you don't use
• Limit login attempts (and rate-limit at the firewall, not just plugin-level)
• Disable directory listing in your server config
• Use a managed host that isolates customers in containers
• Backup off-site, encrypted, and TEST the restore

Things that don't matter (and waste your time)

• Hiding the WordPress version number
• Renaming wp-admin to /secret-admin
• Changing the database prefix on an existing site
• Most 'security' badge/seal plugins

These are security theater. Real attackers don't care about your wp-admin URL or your version number — they scan for known vulnerabilities in outdated plugins. Fix the real stuff.