- Article
- Beginner
- 2 minutes read
- Reviewed August 4, 2026
WordPress security is produced by the complete system, not by WordPress core alone.
A typical website depends on a domain, DNS, hosting, operating system, web server, PHP, database, WordPress core, themes, plugins, custom code, user accounts and external services.
A weakness in any layer can affect the whole website.
WordPress Core
WordPress core includes authentication, capabilities, password hashing, update systems, nonce APIs, validation helpers and security fixes.
Core must remain supported and updated. Security maintenance cannot protect a site that intentionally runs old vulnerable versions indefinitely.
Hosting and Server
The hosting environment controls:
- Operating-system updates.
- Web server and PHP.
- Database software.
- Network filtering.
- File ownership.
- TLS configuration.
- Backups.
- Logs.
- Resource isolation.
Managed hosting can reduce operational work, but responsibility still includes choosing the provider, reviewing controls and maintaining the application.
Themes and Plugins
Extensions execute code with access to WordPress and its data.
A vulnerable, abandoned or malicious extension can bypass an otherwise secure installation. Install only necessary software from trusted sources and maintain an inventory.
Users and Accounts
An attacker who obtains a privileged account may not need a software vulnerability.
Use strong unique passwords, two-factor authentication, least privilege, session review and prompt removal of unused accounts.
Custom Code
Custom themes, plugins and integrations must use secure WordPress APIs.
Important practices include capability checks, nonces for request intent, strict validation, context-appropriate escaping, prepared database queries and safe file handling.
Data and Secrets
WordPress stores public content, private user data, settings and credentials.
Protect configuration files, database accounts, API keys, backups and logs according to sensitivity.
Monitoring and Recovery
Prevention cannot detect every compromise.
Security monitoring should reveal unusual logins, file changes, errors, privilege changes, malware indicators and unexpected network behavior.
Recoverable backups and an incident plan limit damage.
Shared Responsibility
Assign clear ownership between:
- Website owner.
- Hosting provider.
- Developers.
- Administrators.
- Plugin and theme vendors.
- Security or operations teams.
- External service providers.
“The host handles security” is not a complete responsibility model.
Frequently Asked Questions
Is WordPress inherently insecure?
WordPress can be operated securely, but the final site includes extensions, users, hosting and custom configuration that must also be maintained.
Does a security plugin secure every layer?
No. It can provide selected controls and visibility but cannot replace updates, account management, backups and secure code.
Continue Learning
Previous: [Security](/resources/wordpress-manual/security/)
Next: [Common WordPress Security Threats](/resources/wordpress-manual/security/common-security-threats/)