Roughly 13,000 WordPress sites are hacked every day — about 4.7 million per year. And in 2025 alone, security researchers recorded more than 11,300 new WordPress vulnerabilities, a 42% jump over the previous year.

The good news? Most attacks are preventable. The vast majority of breaches happen through known, already-patched holes — not sophisticated zero-days. Here’s how to lock down your WordPress site in 2026.

Where the Threats Actually Come From

91% of vulnerabilities are in plugins — not WordPress core. WordPress core itself is remarkably secure. The real risk is the 30+ plugins the average site runs.

43% of vulnerabilities are exploitable without login. Attackers don’t need your password — an unpatched plugin can hand them the keys directly.

Over 56% of security incidents exploit a flaw that already had a patch available. In other words: more than half of hacked sites were hacked because someone didn’t click “Update.”

Speed matters. The median time from vulnerability disclosure to mass exploitation is now around 5 hours. Attackers use automated botnets that scan thousands of sites per minute for a single unpatched flaw.

The 2026 WordPress Security Checklist

1. Update everything — automatically

Enable auto-updates for plugins, themes, and WordPress minor releases. Given the 5-hour exploitation window, “I’ll update this weekend” is no longer a viable strategy. For business-critical sites, use a staging environment to test major updates before they go live.

2. Ruthlessly audit your plugins

Every plugin is attack surface. Once a quarter, ask three questions about each plugin: Do we still use it? Was it updated in the last 6 months? Does it have a good security track record? Delete (don’t just deactivate) anything that fails.

3. Install a Web Application Firewall (WAF)

A WAF blocks malicious traffic before it reaches WordPress. Options include Cloudflare (network-level, free tier available) and plugin-based firewalls like Wordfence (5M+ active installs) or Solid Security. A WAF is your safety net during the gap between a vulnerability being disclosed and you applying the patch.

4. Enforce two-factor authentication (2FA)

Brute-force login attacks remain one of the most common entry points. Require 2FA for every administrator and editor account. Also: rename the default admin username, and limit login attempts.

5. Fix your file permissions

The correct baseline: directories 755, files 644, and wp-config.php at 600 or 640. Wrong permissions let attackers read your database credentials or write malicious files.

6. Automate off-site backups

Backups are your last line of defense. Use a plugin like UpdraftPlus or Duplicator, schedule daily backups, and store them off-server (Google Drive, S3, Dropbox). Test a restore at least twice a year — a backup you’ve never restored is just a hope.

7. Choose hosting that takes security seriously

In 2026, bargain shared hosting is a gamble. Look for hosts offering server-level malware scanning, isolation between accounts, free SSL, and automatic core updates. Managed WordPress hosting costs more but offloads much of this work.

8. Watch for XSS — the #1 vulnerability type

Cross-site scripting accounts for nearly 48% of all WordPress vulnerabilities. It usually enters through poorly coded plugins and themes. Stick to plugins from reputable developers with active vulnerability disclosure programs — which, notably, EU law now requires for commercial plugins sold to European users.

What to Do If You’ve Already Been Hacked

Take the site offline or into maintenance mode, restore from a clean backup, change every password (WordPress, hosting, database, FTP), update everything, then scan with Wordfence or a professional malware-removal service. Finally, find the entry point — otherwise you’ll be re-hacked within days.

Don’t Have Time for All This?

Security is not a one-time setup — it’s ongoing maintenance. If you’d rather focus on your business, HD Web Mobile offers WordPress security hardening, monitoring, and maintenance plans: we handle updates, backups, firewall configuration, and malware response so you don’t have to.

👉 Contact us for a free security check of your WordPress site.