Website security
WordPress Security
WordPress compromises concentrate in plugins, credentials and writable directories. What to fix, in the order that removes the most risk.
Published 11 Jul 2026 · Updated 26 Aug 2026 · 2 min read
Short answer
WordPress sites are rarely breached through WordPress core. The recurring causes are vulnerable or abandoned plugins and themes, administrator credentials without multi-factor authentication, and a web root where uploaded files can execute — so hardening should start there rather than with a security plugin.
Where do WordPress compromises come from?
| Entry point | Typical scenario | Control that closes it |
|---|---|---|
| Vulnerable plugin | A form or gallery plugin two years out of date | Patch cadence and removal of unused plugins |
| Abandoned theme | A commercial theme with a bundled outdated library | Replace with a maintained theme |
| Credential reuse | An administrator password reused elsewhere and leaked | MFA plus unique credentials |
| Writable uploads | A PHP file uploaded through a media endpoint and executed | Block PHP execution in uploads |
| Supplier access | A former agency account still active | Access reviews at every handover |
What should you harden first?
STEP 01
MFA on all administrators
Then reduce the number of administrator accounts to those who need it.
STEP 02
Patch and prune
Update everything on a schedule and delete plugins and themes you do not use.
STEP 03
Block execution in uploads
Deny PHP execution in wp-content/uploads at the web server level.
STEP 04
Disable file editing
Set DISALLOW_FILE_EDIT so the dashboard cannot be used to write code.
STEP 05
Off-site backups
Not writable from the web server, and restore-tested.
STEP 06
Integrity monitoring
Alert on changes to core, theme and plugin files outside deploy windows.
# Deny PHP execution inside the uploads directory (Apache)
<Directory /var/www/html/wp-content/uploads>
<FilesMatch "\.ph(p[0-9]?|tml)$">
Require all denied
</FilesMatch>
</Directory>How do you verify a WordPress site is clean?
- Compare core, theme and plugin files against official releases rather than trusting a scan verdict.
- List administrators and check for accounts created outside your onboarding process.
- Review scheduled events for tasks that recreate files.
- Check indexed page counts and run a crawler-view diff on key templates.
Sources
- Hardening WordPress — WordPress
Prefer summary updates? Subscribe to the newsletter.