How to Secure Your WordPress Site Without a Plugin (2026) — Complete Hardening Guide

11,334 new WordPress vulnerabilities were found in 2025 — up 42% in a year — and 91% lived in plugins, not WordPress core. That is Patchstack’s State of WordPress Security in 2026 report: the danger is the plugins around WordPress.

So what if the smartest move is hardening the site you already have, not another security plugin? This guide shows you how to secure WordPress site without plugin — no new plugin, no fee. WordPress security without plugin is layers, not one magic setting.

How to Secure WordPress Site Without Plugin: The Checklist

1. Keep WordPress, Themes, and Plugins Updated

Patchstack found heavily targeted flaws were mass-exploited a median of five hours after disclosure; 46% had no patch. Once a patch exists, every hour you wait is an hour attackers know about the hole. Turn on automatic core updates, and update themes and plugins as new versions land. The highest-impact step in this WordPress security checklist — and it costs nothing.

2. Delete Unused Plugins and Themes

Every plugin you installed “to try someday” is a door you forgot you left open — with 91% of new vulnerabilities in plugins, each unused one is pure risk. Delete — do not just deactivate — anything unused; some flaws work even when a plugin is switched off. Replace plugins not updated in over a year.

3. Strong Passwords, New Admin Username

Bots try the same two things millions of times daily: the username admin and weak passwords like password123. Create a new administrator account with an unusual username, log in as it, and delete the old admin user, moving its posts over. Then set a long, unique password — 16+ characters, from a password manager, never reused. For the strongest logins, see how to add two-factor authentication to WordPress.

4. Force HTTPS With SSL

Over plain HTTP, logins and form data travel in readable text, open to anyone on the same public Wi-Fi. Most hosts include a free SSL certificate (usually Let’s Encrypt). Install it, change both URLs under Settings > General to https://, and add this redirect:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

5. Limit Login Attempts With Code

WordPress lets anyone try logging in endlessly — an open invitation to bots. Add this limiter to a child theme’s functions.php — it blocks an IP for 15 minutes after five failures:

add_action( 'wp_login_failed', function() {
    $k = 'fails_' . md5( $_SERVER['REMOTE_ADDR'] );
    set_transient( $k, (int) get_transient( $k ) + 1, 900 );
} );
add_filter( 'authenticate', function( $u ) {
    if ( (int) get_transient( 'fails_' . md5( $_SERVER['REMOTE_ADDR'] ) ) >= 5 )
        return new WP_Error( 'blocked', 'Too many attempts.' );
    return $u;
}, 30 );

Back up functions.php first — one typo locks you out. Read our guide on how to protect WordPress from brute-force attacks for a deeper dive.

6. Disable the File Editor in wp-config.php

By default, any administrator can edit theme and plugin files from the dashboard — so one stolen admin login means full server control in seconds. One line in wp-config.php, above “That’s all, stop editing!”, removes it: define( 'DISALLOW_FILE_EDIT', true ); A two-minute change — one of the best returns when you harden WordPress security.

7. Refresh Your Security Salts

WordPress stores eight secret keys and salts in wp-config.php, protecting login cookies. If they were ever copied from a public example or exposed in an incident, every session on your site rests on a known secret. Visit the official WordPress secret-key generator, copy the eight fresh lines, and paste them over the old ones — signing out everyone instantly, attackers included.

8. Lock Down wp-config.php Permissions

Your wp-config.php holds your database password and salts. The official WordPress hardening guide recommends directories at 755, files at 644, and wp-config.php tighter still, at 600 or 640. Set it in your host’s file manager or over SSH: chmod 600 wp-config.php. If 600 breaks your site, use 640. Never set anything to 777. See our guide on how to secure wp-config.php in WordPress.

9. Block PHP in the Uploads Folder

Here is a real-world pattern seen on hacked sites again and again: an attacker exploits a flaw in a form or plugin and uploads a disguised image — actually a PHP backdoor. Once the server runs it, the attacker owns the site; cleanup takes days, though blocking it takes five minutes. Stop it with a .htaccess file in wp-content/uploads/:

<FilesMatch "\.(php|phtml|php3|php4|php5|phps)$">
    Require all denied
</FilesMatch>

Now a malicious upload is a harmless dead file.

10. Disable XML-RPC You Do Not Need

XML-RPC lets remote apps publish posts and other sites send pingbacks — and gives attackers a second login door: its system.multicall method tries hundreds of passwords per request, unseen by your login limiter. Most sites do not need it in 2026; the REST API replaced it. Disable the authenticated methods with this line in functions.php: add_filter( 'xmlrpc_enabled', '__return_false' ); For full protection, also add this to your root .htaccess — the filter alone does not stop pingbacks:

<Files xmlrpc.php>
    Require all denied
</Files>

Skip the server block only if Jetpack or a mobile app needs XML-RPC. Suspect a hack already? Our guide on how to check if your WordPress site is hacked walks you through the signs.

11. Add Security Headers

Security headers are instructions your server sends with every page — free, and they stop whole classes of attacks. Add these to your root .htaccess (Apache, mod_headers enabled):

<IfModule mod_headers.c>
    Header set X-Content-Type-Options "nosniff"
    Header set X-Frame-Options "SAMEORIGIN"
</IfModule>

X-Frame-Options stops clickjacking; X-Content-Type-Options stops browsers guessing a file’s type — how an uploaded “image” gets run as code. Verify them with a free header-checker tool.

12. Back Up Off-Site

Hardening reduces risk; it never removes it. A backup decides whether a bad day costs you an afternoon or your business. Keep one recent copy off your server — your host’s backup, cloud storage, or your computer. Test the restore too: a backup never restored is a hope, not a plan.

How to Secure WordPress Site Without Plugin: Your Next Steps

Do the first six steps today — updates, deleting unused plugins, a new admin username, HTTPS, a login limiter, and DISALLOW_FILE_EDIT take about an hour and close the doors attackers try first. Then finish the rest this week and change your login URL too — see how to change your WordPress login URL. That is how to secure WordPress site without plugin: layers, not luck.

Hacked sites rarely lack a fancy security plugin. They have an old plugin, a weak password, and an unlocked door. Lock yours now, while it is still a choice. Prefer an expert to secure WordPress website for you? See our WordPress security services or get in touch.

Frequently Asked Questions

Can I secure WordPress without a plugin?

Yes — most WordPress security comes from settings and server configuration: update everything, use strong unique passwords, limit login attempts, disable the file editor, tighten wp-config.php, block PHP in uploads, disable XML-RPC, and add security headers. A security plugin only adds monitoring and a firewall.

Is WordPress secure?

Yes — WordPress core is very secure: Patchstack found only six low-priority core flaws in 2025, against 91% in plugins and 9% in themes. WordPress becomes insecure when owners skip updates, install too many plugins, or use weak logins — follow the WordPress security best practices here.

How do I protect my WordPress site from hackers?

Start with the basics: update everything promptly; delete unused plugins; use a strong unique password plus two-factor authentication; limit login attempts; force HTTPS; and keep off-site backups. Then add the deeper hardening here.

What is the best free WordPress security plugin?

If you still want one, the most widely used free options are Wordfence Security and Solid Security, both with a free firewall, malware scan, and login protection. But a plugin is a supplement, not a substitute: these steps protect you with no security plugin installed, and none can save a site with an outdated plugin, a weak password, and no backups.