WordPress security is ranking insurance: every setting in this guide exists because its absence has cost a site its traffic through a hack. A compromised site loses rankings, trust, and revenue, so hardening WordPress is not optional busywork but a direct protection of your SEO. This checklist covers the twelve settings that matter most, ordered by impact per minute, plus security plugins, what not to bother with, and a simple monthly routine.
The 12 settings ordered by impact
Work through these in order, since the earlier ones give the most protection for the least effort. Each includes the how and the SEO consequence it prevents.
1. Keep everything updated. Set a policy to update WordPress core, plugins, and themes promptly, since outdated software with known vulnerabilities is the single most common way sites get hacked. Enable automatic updates for minor releases and check regularly for the rest. This prevents the injected spam and malware that trigger ranking loss and warnings.
2. Use strong credentials and two factor authentication. Replace weak or reused passwords with strong unique ones for every account, and add two factor authentication to your admin login. This stops the credential guessing and stuffing attacks that let intruders in to deface or inject spam.
3. Change the login URL. Move your login page from the default address to a custom one, which hides it from the automated bots that hammer the standard login. This deep tactic is covered fully in dedicated guides, but even the basic change reduces the brute force attempts that can lead to a breach.
4. Limit login attempts. Restrict how many failed logins are allowed before a temporary lockout, which blocks brute force attacks that try thousands of passwords. This closes a common path to the admin access attackers use to compromise a site.
5. Practice user role hygiene. Give each user only the role they need, remove accounts that are no longer used, and audit your user list for anyone unfamiliar. This prevents both accidental damage and the rogue admin accounts attackers add to keep access.
6. Set correct file permissions. Configure your files and folders with safe permission values so they cannot be written to by unauthorized processes. Loose permissions let attackers inject malicious files, so tightening them removes a common way spam and malware get planted.
7. Disable file editing in the dashboard. Turn off the built in theme and plugin file editor, so that even if an attacker gets into the dashboard, they cannot easily edit your code from there. This limits the damage a partial breach can do.
8. Change the database prefix. Using a non default database table prefix makes certain automated attacks against your database harder. It is a modest hardening step that slightly raises the bar against injection attempts.
9. Choose a good security plugin. Install one reputable security plugin that provides scanning, a firewall, and monitoring, rather than several overlapping ones. A good plugin catches infections and blocks attacks, preventing the compromises that cost rankings.
10. Enable basic firewall protection. Use a firewall, whether from your security plugin or a service, to block malicious traffic and known attack patterns before they reach your site. This stops many attacks at the door.
11. Turn on activity logging. Log admin actions and important changes so you can see who did what and spot suspicious activity early. Logging helps you detect a breach quickly, limiting how long any hack damages your rankings unnoticed.
12. Monitor uptime and defacement. Set up monitoring that alerts you if your site goes down or its content changes unexpectedly. Early alerts mean you catch a hack or outage fast, minimizing the trust and ranking damage that comes from a compromised site staying live.
Where the vulnerabilities actually are
Before working through any hardening list, it is worth knowing which part of your site the risk actually sits in, because the answer is lopsided enough to change how you spend your time.
Patchstack, which tracks WordPress vulnerabilities for a living, found that of the new vulnerabilities it recorded in 2024, 96 percent were in plugins and 4 percent in themes, with seven in WordPress core. In 2025 the split was 91 percent plugins and 9 percent themes, with six in core, all low priority. Seven, then six, across two years, for software running a large share of the web.
WordPress itself is not your problem. Your plugins are, and effectively only your plugins. That is not an argument for skipping core updates, which are easy and automatic, but it does mean that if your security effort is spread evenly across everything, it is aimed in the wrong place.
It also reframes the standard first instruction. “Keep everything updated” is right, but the plugin that hurts you is usually not the one you forgot to update. It is the one with no update available at all.
The plugin audit nobody does
Plugins get abandoned. The developer stops maintaining it, a vulnerability is found, and no patch is ever written, while the plugin sits on thousands of sites still doing its job perfectly well as far as anyone can see. Patchstack reports that 1,614 plugins and themes were removed from the WordPress repository during 2024 over unpatched security issues, and that vulnerabilities disclosed in abandoned plugins mostly still have active installations.
This is the failure mode your update screen cannot show you. A plugin with no available update looks identical to a plugin that is fully up to date. Both display nothing. Once a year, do this instead.
Check when each plugin was last updated. Open its page on the WordPress repository and look at the last updated date and the tested up to version. Anything untouched for a year deserves a hard look, and anything untouched for two should be replaced or removed. Also check whether the page still exists at all, because a plugin pulled from the repository still runs happily on your site and simply stops receiving anything.
Delete what you are not using, do not just deactivate it. A deactivated plugin’s files are still on your server and can still be reachable, so deactivating is not removal. If you are not using it, delete it.
Count them. Every plugin is code written by someone you have never met with the ability to do anything on your site. Twelve plugins is a smaller attack surface than thirty, and the fastest security improvement available to most sites is deleting the eight things nobody has opened in two years.
Two things most WordPress security guides still miss
Application passwords. WordPress can issue separate passwords for apps and integrations to use, and they are genuinely useful, but they have two properties worth knowing. They bypass two factor authentication, because a machine cannot answer a prompt on your phone, and they survive a normal password change. That means an application password created by an attacker is a working way back in even after you have rotated your login and turned on 2FA. If you have ever been compromised, or you inherited a site, open the profile of every administrator and review the application passwords listed there, and revoke anything you cannot account for.
User enumeration. Before an attacker can guess a password they need a username, and WordPress will often supply it. Requesting the site with an author parameter redirects to that author’s page and reveals the login name, and the REST API users endpoint can list accounts outright. This is why a login page that already knows your username sees so much more traffic than one that does not. Most security plugins can block both, and it is usually a single toggle. Pair it with never using admin, editor or your own first name as a login name.
And a note on XML-RPC, since every list tells you to disable it. It is a legitimate old interface that Jetpack, the mobile app and some other tools genuinely use, and its real problem is that one of its methods lets an attacker attempt many passwords in a single request, which makes brute forcing cheap. If nothing you run needs it, disable it. If something does, do not break your own site over it: leave it on and let your firewall rate limit it, which addresses the actual risk rather than the name.
Security plugins compared
A good security plugin does much of this work for you, so it is worth choosing one well. The leading options generally offer a firewall, malware scanning, login protection, and monitoring, with free tiers that cover the essentials for most small sites and paid tiers that add advanced firewall rules and faster scanning.
The honest picture is that the popular security plugins each have a capable free version that handles the core protections a small site needs, and you only need a paid tier if you want premium firewall rules, scheduled scanning, or priority support. Rather than naming a single winner, since features and reputations shift, pick a current, well reviewed plugin, install only one to avoid conflicts, and configure it properly rather than assuming installation alone protects you. A well configured free security plugin plus the settings above covers most sites well.
What NOT to bother with
Some security advice is theater that wastes time without meaningfully protecting you, so skip it. Obsessively hiding your WordPress version number does little, since attackers scan for vulnerabilities directly rather than reading version numbers. Installing multiple security plugins at once causes conflicts and slows your site without adding protection, so use just one.
Endlessly tweaking obscure settings for marginal gains distracts from the high impact basics like updates and strong credentials. Chasing every scary sounding tip you read can leave you busy but no safer, while neglecting the fundamentals. The rule is to focus your effort on the settings with real impact, updates, credentials, login protection, a firewall, and monitoring, and not to waste time on cosmetic measures that feel productive but change little. Good security is mostly doing the important basics consistently, not collecting obscure tweaks.
Beyond WordPress: hosting and account security
WordPress settings are only part of the picture, since a site can be compromised through its hosting or connected accounts too. Choose quality hosting that takes security seriously, with isolation between sites, malware scanning, and prompt patching of server software, because a weak host can undermine even a well hardened WordPress install.
Secure your hosting account itself with a strong unique password and two factor authentication, since access to your hosting panel is effectively access to everything. Protect your domain registrar account the same way, because losing control of your domain is as damaging as losing the site. Be careful with FTP and database credentials, using secure connections and strong passwords, and avoid sharing logins. Your email account matters too, since it is often the recovery route for everything else, so it deserves strong protection.
Thinking about security as covering your whole stack, WordPress, hosting, domain, and email, rather than just the site, closes the gaps attackers exploit. Many breaches happen not through WordPress directly but through a weak password on a connected account, so extending your good habits to every part of your setup is what makes the protection complete.
The 15 minute monthly security routine
Security is not a one time task, so build a short monthly routine that keeps you protected. Spend the first few minutes checking that WordPress core, plugins, and themes are all updated, applying anything pending. Then review your users, removing any unfamiliar or unused accounts and confirming roles are correct.
Run a malware scan with your security plugin and check its report, and glance at your activity log and any security alerts for anything unusual. Confirm your monitoring and backups are working, since you will want them if something goes wrong. Finally, check your Search Console Security Issues report for a clean bill of health. This fifteen minute routine, done monthly, catches problems early and keeps your defenses current, which is far cheaper than recovering from a hack that slipped through neglected basics.
Verdict checklist
WordPress security protects your rankings by preventing the hacks that cause warnings, deindexing, and trust loss. Prioritize the high impact settings: keep everything updated, use strong credentials with two factor authentication, protect your login, tighten file permissions, and run one good security plugin with a firewall and monitoring.
Add the supporting steps of user hygiene, disabled file editing, logging, and uptime monitoring, and skip the security theater that wastes time. Then keep it all current with a fifteen minute monthly routine. Treat security as ranking insurance you maintain before you need it, since a secure site quietly protects the traffic that an insecure one can lose overnight.
None of these settings are glamorous, and most take only minutes, but together they are the difference between a site that shrugs off the constant automated attacks the web faces and one that becomes another hacked statistic. For the wider context, see our pillar on hacked websites and SEO and our guide to cybersecurity for small businesses.
Frequently asked questions
Which security plugin is best for WordPress?
There is no single best security plugin, but the leading options all offer a firewall, malware scanning, and login protection, with capable free tiers that suit most small sites. Rather than a fixed winner, since features and reputations change, choose a current, well reviewed plugin, install only one to avoid conflicts, and configure it properly. A well set up free security plugin, combined with strong credentials and updates, protects most sites well.
Does a security plugin slow down my site?
A single, well chosen security plugin has a modest performance impact that is usually worth the protection, and good plugins are optimized to minimize it. Slowdowns mainly happen when you install several overlapping security plugins, which conflict and add unnecessary load. Use just one reputable plugin, keep it configured sensibly, and pair it with good hosting and caching, and the small overhead is a fair trade for preventing a costly hack.
Is changing the login URL enough?
Changing the login URL helps by hiding your login from automated bots, but it is not enough on its own. It should be one layer among several, alongside strong credentials, two factor authentication, limiting login attempts, and keeping everything updated. Security works through multiple layers, so no single setting is sufficient. Changing the login URL reduces attacks but must be combined with the other fundamentals to genuinely protect your site.
Do I need a firewall on shared hosting?
Yes, a firewall is worthwhile even on shared hosting, since it blocks malicious traffic and attack patterns before they reach your site, adding protection your host may not fully provide. You can use a firewall from a reputable security plugin or a service. On shared hosting, where a compromise can be especially disruptive, a firewall is a valuable layer, so it is worth enabling one alongside your other security basics.
How often should I update plugins?
Update plugins promptly, ideally as soon as updates are available, since outdated plugins with known vulnerabilities are a leading cause of hacks. Enable automatic updates for trusted plugins where you can, and check manually at least weekly, or as part of a monthly security routine at minimum. Fast updates close the vulnerabilities attackers exploit, so timely updating is one of the most important and effective security habits for protecting your site.
Are WordPress plugins really the main security risk?
Overwhelmingly, yes. Patchstack recorded 96 percent of new WordPress vulnerabilities in plugins during 2024, with 4 percent in themes and seven in core. In 2025 it was 91 percent plugins, 9 percent themes and six low priority core issues. WordPress core is not where sites get broken into, so security effort spread evenly across everything is aimed in the wrong place.
How do I know if a plugin has been abandoned?
Check its page on the WordPress repository for the last updated date and the tested up to version. A year without an update deserves a hard look and two years means replace it. Also check the page still exists, because a plugin removed from the repository keeps running on your site while silently receiving nothing again. Patchstack reports 1,614 plugins and themes were pulled from the repository in 2024 over unpatched security issues.
Do application passwords bypass two-factor authentication?
Yes, by design, because an integration cannot answer a prompt on your phone. They also survive an ordinary password change. That combination means an application password created by an attacker still works after you have changed your password and enabled 2FA, so review the application passwords on every administrator account after any compromise and revoke anything you do not recognise.