// THE HONEST ANSWER
What actually gets WordPress sites hacked
Almost always one of two things: a plugin or theme running a vulnerability patched months ago, or an admin login that was weak, reused or shared. Not exotic attacks, just a bot scanning for a version number it already knows how to exploit.
Out-of-date plugins and themes
Security fixes are published openly. The day a fix ships, the flaw becomes a public target list of everyone still running the old version.
Weak or reused admin logins
A password reused from a site that has since been breached, or a contractor account nobody removed. Bots try leaked credential lists constantly.
Abandoned plugins
A plugin not updated in two years is not stable, it is unowned. When a vulnerability turns up in it, no fix is coming.
The server underneath
An unsupported PHP version or an unpatched host puts the site at risk however clean the WordPress install is.
// LOGIN HARDENING
Login hardening: passwords, two-factor and lockouts
Unique passwords plus two-factor authentication on every administrator account. That combination stops the overwhelming majority of login attacks on a small business site, and it takes minutes.
- Give every admin a long, unique password from a password manager. One you can remember is one a list can guess.
- Turn on two-factor for every administrator and editor. An authenticator app or hardware key beats SMS. Wordfence and Solid Security both offer it.
- Limit login attempts and lock out repeated failures, so credential-stuffing bots stop getting unlimited tries.
- Delete accounts you no longer use, and give everyone else the lowest role that does their job.
- Treat a password reset as a login: the mailbox behind it needs its own two-factor, and the site needs HTTPS throughout.
A password strength checker is a symptom-level fix, not a strategy. A meter that turns green when you add a number can't tell you whether that password already appeared in a breach, and real attacks use leaked lists. It's a nudge, not a control.
// FIREWALL & SCANNING
Firewalls and scanning: what they do and don't do
A web application firewall blocks requests matching known attack patterns before they reach your code, and a scanner flags files that don't match known-good versions. Both are useful. Neither patches anything, which is why "the best firewall plugin for WordPress" is the wrong question when the stack underneath hasn't been touched in a year.
What it genuinely does
Blocks the obvious traffic: brute-force floods, injection attempts, scanners probing for a known vulnerable file path.
What it does not do
It patches nothing. The flaw is still there, and the firewall is only pattern-matching requests that might reach for it.
Where it runs matters
A plugin firewall filters inside WordPress, after the request has hit your server. A host or cloud firewall filters earlier, which is stronger.
Wordfence, Sucuri and Solid Security are all reasonable. Pick one, configure it properly, then go and do the updates.
// HIGHEST LEVERAGE
Keeping core, themes and plugins current
This is the single highest-leverage security action available to you. Security releases are public by design, so the moment a fix ships, scanners start hunting for sites still running the old version. That gap is where most compromises happen.
- Turn on automatic updates for WordPress core minor releases. Those are almost always security fixes.
- Update plugins on a schedule you will actually keep. Fortnightly beats "when I remember".
- Test on staging first if the site takes bookings or payments.
- Delete plugins you are not using. Deactivated is not removed, and the files still sit on the server.
- "Last updated three years ago" on a plugin page is a security finding, not a detail.
// XSS IN PLAIN ENGLISH
Cross-site scripting, explained without the jargon
Cross-site scripting (XSS) is when an attacker gets their own code onto one of your pages, so it runs in a visitor's browser as though you put it there. That means stolen form submissions, injected spam links, or a fake login prompt under your domain.
It happens when a site takes text from a visitor, a form field, a search box, a comment, then prints it back without stripping code out. On a site you didn't build, the vector is almost always an unmaintained form plugin, page builder or slider. Update it, or replace it.
// THE LAYER UNDERNEATH
Server security, and why ecommerce raises the stakes
WordPress security stops at the layer beneath it. If the server, the PHP version or the hosting account is out of date, nothing in the admin dashboard makes up for it.
- Run a currently supported PHP version. Old releases stop getting security fixes long before the site visibly breaks.
- HTTPS on every page, so logins and form submissions are never sent unencrypted.
- Sensible file permissions, file editing disabled in the admin, and SFTP or SSH rather than plain FTP.
- Staging kept separate from production, and out of Google's index.
Take payments and the stakes rise. The safest structure for a small store is one where card details never touch your server: a hosted payment page or gateway-provided fields. That keeps your PCI DSS obligations small too.
// WHAT WE DO
What we do when we take over a site's security
We audit what is actually running, patch it, harden the logins, and tell you plainly what is worth fixing and what is not.
- A full inventory of core, theme and plugin versions, with known vulnerabilities and abandoned plugins flagged in plain language.
- Removing what you are not using. Usually the fastest win available, and it costs nothing.
- Updates applied properly, on staging first where the site earns money.
- Admin accounts cleaned up, two-factor enabled, and a firewall and scanner configured for real rather than left on defaults.
- Backups test-restored, because hardening only covers you until the day it does not.
Ongoing security lives in our monthly WordPress maintenance plan, from $170 a month, on sites we built and sites we didn't. We scope yours first and confirm the monthly number before anything starts. If the site is fine and you should just keep the plugins current yourself, we'll say that.
// WHERE TO NEXT
Already compromised, or nothing to restore from?
Hardening is what you do before something goes wrong. If it already has, WordPress malware removal covers the cleanup. No working copy of the site anywhere? Start with WordPress backups. For ongoing cost, see what WordPress maintenance actually costs, or get a local team on it with website maintenance in Darwin. Rather not run WordPress at all? Here is what we build instead.
// QUESTIONS
Straight answers on WordPress security
Not sure how exposed your site is, or which of these applies to you? Send us the URL and we'll tell you straight.
Get in touchWhat is the best firewall plugin for WordPress?
Wordfence, Sucuri and Solid Security are all reasonable, and the choice matters less than people think. A firewall filters requests matching known attack patterns, it does not patch the flaw underneath. If your plugins are a year out of date, no firewall fixes that.
Do I need two-factor authentication on my WordPress site?
Yes, on every administrator and editor account. Two-factor plus a unique, randomly generated password stops the overwhelming majority of login attacks, and it takes minutes per user. An authenticator app beats SMS codes.
Is a password strength checker enough to secure WordPress logins?
No. A strength meter tells you a password looks complicated, not whether it has already appeared in a breach. Most credential attacks use lists of real leaked passwords. Generate passwords in a password manager and add two-factor.
How do I reset a WordPress password securely?
Reset from the login screen so the link goes to the account email, and make sure that mailbox has two-factor, because whoever controls the inbox controls the login. Check the site is on HTTPS, and log out other sessions afterwards.
How do I stop XSS attacks on my WordPress site?
Keep every plugin current and remove the abandoned ones. Cross-site scripting almost always arrives through an unmaintained form plugin, page builder, slider or review widget with a known input-handling flaw. Removing the plugin removes the problem.
Can Web Blend secure a WordPress site it didn't build?
Yes. Updates, backups, security patching and monitoring are real ongoing work on WordPress, and we do it on a monthly maintenance plan from $170 a month, on sites we didn't build. We audit what's running and scope the site first, then confirm the monthly number before anything starts, because a brochure site and a WooCommerce store are not the same job.
// READY WHEN YOU ARE
Not sure what's running on your site?
Send us the URL. We'll tell you what's out of date, what's exposed and what needs doing, then quote one number.
Get your site checked