WordPress Security Hardening Checklist for 2026 (with WP-CLI Checks)

Most WordPress compromises aren't clever. They're an out-of-date plugin, an unthrottled login,
a reused admin password, or a backup that didn't exist. Here's the checklist I'd run, ordered
by risk removed per minute, with a command to verify each item.

1. Updates (plugins and themes first)

wp core check-update
wp plugin list --update=available
wp theme list --update=available
wp plugin list --status=inactive   # delete these

Third-party plugins are where real-world compromises overwhelmingly start. Inactive plugins are
still on disk and still reachable, so delete them rather than deactivate them.

2. Login and 2FA

Rate-limit login attempts per IP, drop the admin username, and require 2FA for every
privileged account. Credential-stuffing uses leaked passwords, so a second factor beats a
stronger password. Check passwords against breaches with k-anonymity (only the first five
characters of the SHA-1 hash leave the server) — Loyal Security does this against the Have I Been
Pwned range API and only warns, never blocks.

3. Put a WAF in front of PHP, and trust the right proxies

A WAF drops known attack patterns (SQLi, XSS, LFI/RFI, traversal, RCE) before your code sees
them. Where it runs matters: Loyal Security's Optimized Mode loads via a lightweight prepend
before WordPress boots; Standard Mode runs inside WordPress for hosts that can't prepend.

Behind a CDN or proxy, configure trusted proxies, or every rate limit and block applies to the
proxy's IP instead of the attacker's.

4. Backups you've actually restored

Off-server, several generations, restored to staging at least once. Loyal Security's backups
include a downloadable recovery tool that restores even when WordPress won't load.

5. Lock down configuration

<?php
// wp-config.php
define( 'DISALLOW_FILE_EDIT', true );

Also: directory browsing off, no PHP execution in uploads/, sensitive files not web-readable,
sane permissions (755 dirs / 644 files as a baseline), XML-RPC off if unused, REST user
enumeration restricted. Loyal Security generates the .htaccess/Nginx rules and wp-config
hardening from toggles.

6. Security headers, CSP in report-only first

X-Content-Type-Options, X-Frame-Options or frame-ancestors, Referrer-Policy,
Permissions-Policy, HSTS once everything is HTTPS, and a CSP. The CSP is the one that breaks
sites, so start in report-only mode and enforce later. The plugin's CSP manager builds the policy
from resources your site actually loads.

7. Integrity, malware, database

wp core verify-checksums
wp plugin verify-checksums --all
wp loyal-security scan

The WP-CLI checksum commands can't see themes, mu-plugins, drop-ins or premium plugins; baseline
diffing can. Don't forget the database: injected scripts, spam links, a hijacked siteurl and
rogue admins live there, where a file scanner never looks.

8. Audit log, access review, re-check

wp user list --role=administrator --fields=ID,user_login,user_email,user_registered
wp loyal-security status

Keep 90 days of who-changed-what, review administrators, and re-run all of this monthly — see
the monthly routine.

Full version

This is the short form. The longer write-up, with the reasoning behind each step and the
settings that cover it, is on the blog:
WordPress Security Hardening Checklist for 2026.
Related: WordPress Security Plugins and Performance.