Most WordPress sites don’t get hacked through some clever exploit — they get hacked because a plugin was three versions out of date, or an old admin account with a weak password was never removed.
The basics that actually matter
- Keep WordPress core, themes, and plugins updated. Most breaches exploit a known, already-patched vulnerability — the patch existed, it just wasn’t applied.
- Remove admin accounts you don’t need. Every former employee or old freelancer with standing access is another way in that has nothing to do with your own security.
- Use unique passwords, not shared ones. If one site’s password leaks and it’s reused on your admin login, that’s the whole job done for an attacker.
- Take backups, and actually test restoring one. A backup you’ve never tried to restore isn’t a backup you can rely on.
Why this is usually a hosting problem, not just a plugin one
A security plugin can flag a problem on your site. It can’t patch the server it’s running on, manage who has FTP or SSH access, or restore from a clean backup if the worst happens. That’s infrastructure, not WordPress configuration.
What we do
Security isn’t bolted on afterwards — it’s part of how we build and host every site, backed by an actual platform engineering and security background, not a plugin bought off a marketplace. See our hosting, or get in touch if you’re not sure your current site is covered.