WordPress security has a reputation problem that is not quite fair. WordPress itself is rarely what gets broken. According to Patchstack’s State of WordPress Security in 2026 report, researchers found 11,334 new vulnerabilities across the WordPress ecosystem in 2025, a 42% jump from the year before, and only six of them were in WordPress core. All six were low risk. About 91% were in plugins and the rest were in themes.
So the real question for a site owner is not whether WordPress is safe. It is how much risk your plugins, your logins and your hosting are quietly adding. This guide goes through where attacks come from, the changes worth making today and what to do if your site is already compromised.
Where WordPress security breaks down in practice
Most breaches follow a short list of paths:
- A vulnerable plugin. This is the main one. The same Patchstack report found that 46% of vulnerabilities had no patch available when they were publicly disclosed, so updating alone does not always close the door.
- Nulled or pirated plugins and themes. A “free” copy of a premium theme is a common way to get a backdoor installed on your own server. Premium licenses are billed in dollars, which makes nulled copies tempting for small agencies and site owners in Pakistan. It is also one of the cheapest ways to lose a client’s site.
- Weak or reused passwords. Brute force attempts against wp-login.php are constant background noise on almost every site.
- Abandoned plugins. A plugin that has not been updated in years still runs on your server with full access. Developers also sell plugins, and a new owner can ship a malicious update.
- Weak hosting. The same report found that hosting-level defenses blocked only 12% of actively exploited WordPress vulnerabilities. A decent host helps, but it is not a substitute for your own security setup.
One more shift worth knowing: attackers increasingly inject code into legitimate theme and plugin files instead of dropping an obviously strange new file. That makes “delete the file that looks wrong” a weak cleanup method.
How to secure a WordPress site: the changes that matter most
You can skip most of the long checklists you see online. These are the changes that cut the most risk per hour spent.
1. Remove what you do not use. Delete inactive plugins and themes, not just deactivate them. Every plugin is code that can be attacked, and the numbers above show where the risk sits. If a plugin does something you could do with five lines of code or a built-in setting, drop the plugin.
2. Update on a schedule. Core, plugins and themes, in that order, after a backup. Our website maintenance guide covers a safe update routine, so it is not repeated here.
3. Protect the login page. Use a unique password from a password manager, limit login attempts and turn on two-factor authentication for every administrator and editor account. Two-factor is available through several security plugins and standalone plugins, and an authenticator app is a better choice than SMS codes. Delete the default “admin” username if it still exists and give each person their own account instead of sharing one.
4. Give users only the access they need. A content writer does not need Administrator. Review the Users screen every few months and remove accounts that belong to people who have left.
5. Turn off the built-in file editor. Add this line to wp-config.php so a hacked admin account cannot rewrite your theme and plugin code from the dashboard:
define( 'DISALLOW_FILE_EDIT', true );
6. Use HTTPS everywhere. Install an SSL certificate (many hosts include one free), set your site URL to https and redirect all http traffic to it. Check for mixed content warnings after the switch.
7. Set sane file permissions. A common baseline is 644 for files and 755 for directories, with wp-config.php locked down further if your host allows it. Never leave anything at 777.
8. Add security headers. Headers tell browsers how strictly to treat your pages. The usual set is Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy, with Content-Security-Policy as a later step because it can break scripts if configured carelessly. You can set them in your server config, in .htaccess or through a plugin.
9. Keep backups outside the server. A backup stored in the same account as the site can be encrypted or deleted by the same attacker. Send copies to remote storage and test a restore at least once.
Do you need a WordPress security plugin?
For WordPress security specifically, plugins are a tool, not the whole plan.
For most sites, yes, one good one. The plugin gives you a firewall layer, login protection and malware scanning that you would otherwise assemble by hand. For WordPress security plugins, the names that come up most often are Wordfence, Sucuri, Patchstack, Solid Security (formerly iThemes Security), All In One WP Security and MalCare. Each takes a slightly different approach:
| Type | What it does | Things to check |
|---|---|---|
| Endpoint plugin firewall | Runs inside WordPress, scans files, blocks bad requests | Uses server resources, so check performance on shared hosting |
| Cloud firewall (WAF) | Filters traffic before it reaches your server | Needs a DNS change, usually a paid plan |
| Vulnerability-focused | Alerts you to known plugin flaws and can apply virtual patches | Best as a layer on top of updates, not a replacement |
| Scanner and cleanup service | Detects and removes malware | Cleanup limits and response times differ by plan |
How to choose without overthinking it:
- Install one security plugin, not three. Overlapping firewalls cause conflicts and slow sites down.
- Check whether the free tier does what you need before paying. Real-time protection and malware removal are the features most often locked behind paid plans.
- For a WooCommerce store, look for brute force protection, a firewall that understands checkout pages and clear support for incident response.
- Check that it is actively maintained and compatible with your host. A security plugin that has not been updated recently defeats its own purpose.
WordPress security firewall, malware scanning and monitoring
A web application firewall (WAF) blocks malicious requests such as SQL injection attempts and known exploit patterns before they run. A plugin-level firewall is easier to start with. A cloud WAF in front of the site also absorbs a lot of junk traffic, which helps with bot floods and some DDoS attempts, although serious DDoS protection needs a CDN or network-level service rather than a plugin alone.
Malware scanning compares your files against known-good copies and known malware signatures. Run it on a schedule, not only after something goes wrong. Pair it with uptime monitoring and email alerts for new admin users and changed core files, since those are the early signs of a breach.
How to tell if your WordPress site has been hacked
Common signs:
- Google shows a “This site may be hacked” or deceptive site warning.
- Pages redirect to spam or pharmacy pages, sometimes only for visitors coming from Google or on mobile.
- New admin users appear that you did not create.
- Your host suspends the account or sends an abuse notice.
- Unfamiliar files show up in wp-content or the site root.
- Search results display Japanese or pharma keywords next to your pages.
- The site slows down for no clear reason.
Check Google Search Console’s Security issues report and a free external scanner such as Sucuri SiteCheck. External scanners miss some infections, so a clean result is useful but not proof.
What to do after a WordPress hack
- Put the site in maintenance mode or take it offline so visitors are not exposed.
- Back up the infected site before changing anything. You want evidence and a fallback.
- Change every password: WordPress users, hosting panel, FTP or SFTP, database and email accounts tied to the domain. Replace the secret keys in wp-config.php so existing login sessions stop working.
- Find the entry point. Check which plugin or theme was outdated or nulled, and review access logs if your host provides them.
- Restore from a clean backup taken before the infection, then update everything immediately. If you do not have a clean backup, you will need a thorough cleanup: reinstall core, replace plugin and theme files with fresh copies from trusted sources, and inspect the database and uploads folder for injected code.
- Remove unknown users, scheduled tasks and files. Backdoors often survive a cleanup so the site is reinfected within days.
- Request a review in Search Console if Google flagged the site.
- Close the gap that let them in, otherwise you are only resetting the clock.
If the same infection returns after cleanup, stop patching and get a developer to audit the server, since the problem may sit outside WordPress itself. For ongoing protection and routine care, that is part of what our web development services cover, and your hosting choice matters too, so see our guide to web hosting in Pakistan for what to look for in a host.
When to hire a WordPress security specialist
Fixing a small brochure site yourself is realistic if you follow the checklist above. Bring in a specialist when you run a store that takes payments, hold customer data, have been reinfected after a cleanup or need an audit for a client or compliance reason. Ask any provider what a cleanup includes, how fast they respond, whether they find the root cause and what monitoring you get afterward. A quote that only says “malware removal” with no root cause analysis is not enough.
Frequently asked questions about WordPress security
Q1. Is WordPress secure?
On WordPress security, core is generally well maintained, and Patchstack’s 2026 report found only six core vulnerabilities in 2025, all low risk. Most real-world problems come from plugins, themes, weak passwords and poor hosting, so a well-maintained site with few plugins can be very secure.
Q2. How do I secure a WordPress site?
Remove unused plugins and themes, keep everything updated, use strong unique passwords with two-factor authentication, limit login attempts, install a reputable security plugin, use HTTPS and keep off-site backups.
Q3. What is the best plugin for WordPress security?
There is no single best option. Wordfence, Sucuri, Patchstack, Solid Security, All In One WP Security and MalCare all have strengths. Choose one based on whether you need a firewall, vulnerability alerts or cleanup support, and install only one at a time.
Q4. How do I set up two-factor authentication on WordPress?
Install a security plugin or dedicated two-factor plugin that supports authenticator apps, enable it in your profile settings, scan the QR code with your authenticator app and save the backup codes. Require it for all administrator and editor accounts.
Q5. Which WordPress security headers should I use?
Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and Permissions-Policy are a practical starting set. Add Content-Security-Policy carefully because a wrong rule can break scripts.
Q6. How do I know if my WordPress site has been hacked?
Look for Google security warnings, unexpected redirects, unknown admin users, unfamiliar files, strange search listings and sudden slowdowns. Check Search Console’s Security issues report and scan with an external tool.
Q7. How do I recover a hacked WordPress website?
Take the site offline, back it up, change all passwords and secret keys, restore from a clean backup or clean the files and database, update everything and find the entry point so the hack does not repeat.
Q8. Does a security plugin slow down my site?
Some do, especially endpoint scanners on busy shared hosting. Run scans off-peak, avoid stacking multiple security plugins and compare performance before and after installation.
Q9. Are nulled WordPress themes and plugins safe?
No. Pirated copies often contain backdoors or malware and give you no legitimate updates. Use the free version, a legitimate license or a lighter alternative instead.
Q10. How often should I back up my WordPress site?
Daily for stores and sites that change often, weekly for mostly static sites. Store backups off the server and test a restore periodically.
Q11. Does hosting affect WordPress security?
Yes, hosting is part of WordPress security. A good host provides server hardening, isolation between accounts, backups and quick support. Hosting-level defenses alone do not stop most plugin exploits, so you still need your own protections.