🛡️ WordPress 6.9 Security Guide: Protect Your Site from Hackers 2026

Implement Audit Logging

// Custom audit log
function log_security_event($action, $details = []) {
    global $wpdb;
    
    $log = [
        'user_id' => get_current_user_id(),
        'action' => $action,
        'details' => json_encode($details),
        'ip' => $_SERVER['REMOTE_ADDR'],
        'user_agent' => $_SERVER['HTTP_USER_AGENT'],
        'timestamp' => current_time('mysql')
    ];
    
    $wpdb->insert($wpdb->prefix . 'security_audit', $log);
}

// Track logins
add_action('wp_login', function($user_login, $user) {
    log_security_event('login_success', ['user' => $user_login]);
}, 10, 2);

add_action('wp_login_failed', function($username) {
    log_security_event('login_failed', ['username' => $username]);
});

Set Up File Integrity Monitoring

#!/bin/bash
# AIDE - Advanced Intrusion Detection Environment
apt install aide
aideinit
mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# Daily check
aide --check | mail -s "AIDE Report" admin@domain.com

# Tripwire alternative
tripwire --check
tripwire --update --twfile /etc/tripwire/tw.pol

Configure Real-Time Alerts

// Slack alerts for critical events
function send_slack_alert($message) {
    $webhook = 'https://hooks.slack.com/services/YOUR/WEBHOOK';
    
    $data = json_encode(['text' => $message]);
    
    wp_remote_post($webhook, [
        'headers' => ['Content-Type' => 'application/json'],
        'body' => $data
    ]);
}

// Alert on admin creation
add_action('user_register', function($user_id) {
    if (user_can($user_id, 'administrator')) {
        send_slack_alert("🚨 New admin created: User ID $user_id");
    }
});

Monitor Failed Login Attempts

#!/bin/bash
# Analyze auth logs
grep "Failed password" /var/log/auth.log | awk '{print $1,$2,$3,$11}' | sort | uniq -c | sort -nr

# Fail2ban configuration
apt install fail2ban
cat > /etc/fail2ban/jail.local << EOF
[wordpress]
enabled = true
port = http,https
filter = wordpress
logpath = /var/log/auth.log
maxretry = 5
bantime = 3600
EOF

Regular Security Audits

#!/bin/bash
# Monthly security audit script

echo "=== WordPress Security Audit ==="
date

echo -e "\n1. Checking WordPress version"
wp core version

echo -e "\n2. Verifying core files"
wp core verify-checksums

echo -e "\n3. Checking plugin vulnerabilities"
wpscan --url https://yoursite.com --api-token YOUR_TOKEN

echo -e "\n4. Scanning for malware"
clamscan -r /var/www/html/

echo -e "\n5. Checking file permissions"
find /var/www/html -type f -perm 777 -ls

echo -e "\n6. Reviewing user accounts"
wp user list

echo -e "\n7. Checking SSL expiration"
echo | openssl s_client -servername yoursite.com -connect yoursite.com:443 2>/dev/null | openssl x509 -noout -dates

echo -e "\n8. Testing backups"
ls -lh /backups/latest/

echo -e "\n=== Audit Complete ==="

Bonus: 5 Advanced Security Tips

• 51. Use Web Application Firewall (Cloudflare, Sucuri)
• 52. Implement Security Headers scanner (securityheaders.com)
• 53. Disable XML-RPC (add to .htaccess: RewriteRule ^xmlrpc.php - [F])
• 54. Use Security Keys Salts generator (api.wordpress.org/secret-key/1.1/salt/)
• 55. Regular penetration testing with tools like WPScan