In 2025, security researchers discovered 10,700+ new WordPress vulnerabilities—that’s 29 per day. And 96% of them came from plugins.
If that number seems alarming, it should be. But here’s what most security guides won’t tell you: the threat landscape has fundamentally shifted. AI-powered attack tools can now scan and exploit vulnerable sites in minutes. Supply chain attacks—where hackers compromise plugins at the source—have become increasingly common. The old advice about “keeping things updated” is necessary but no longer sufficient.
We’ve been securing WordPress sites since 2012. What follows is the approach we take with client sites, in priority order.
Start With What Actually Gets Exploited
According to Patchstack’s 2025 security report, plugins cause 96% of all WordPress security breaches. Themes account for about 4%. WordPress core? Virtually zero.
So the first question isn’t “is WordPress secure?” It’s “what plugins are you running, and do you actually need them?”
We audit every client site with this mindset. A site running 40 plugins when it needs 15 isn’t just slow—it’s a security liability. Each plugin is a potential entry point.
The Plugin Audit
Before adding any security measures, we reduce the attack surface:
- Delete unused plugins — Not just deactivate. Delete them entirely.
- Check update frequency — Plugins not updated in 12+ months are red flags.
- Verify developer reputation — Check the plugin’s download count, reviews, and support forum activity.
- Question necessity — Can this functionality be achieved with existing tools or custom code?
This sounds basic. It is. But we’ve seen $2M/year WooCommerce stores running social sharing plugins installed in 2021 and forgotten about.
Updates Are Non-Negotiable (But Timing Matters)
Yes, you need to update WordPress core, themes, and plugins. But blindly enabling auto-updates for everything can break your site.
Our approach:
- WordPress core — Auto-update minor versions (6.4.1 → 6.4.2). Manual review for major versions (6.4 → 6.5).
- Security plugins — Auto-update always. These need to respond to new threats immediately.
- Other plugins — Update weekly on a staging environment first, then push to production.
- Themes — Update monthly unless a security patch is released.
The key is having a staging environment. Testing updates before they hit your live site prevents the “my site broke after an update” scenario that makes business owners avoid updates entirely.
Authentication Is Your First Real Defense
According to Melapress’s 2025 security survey, brute force attacks remain the most common threat. The fixes aren’t complicated.
Change the Default Username
Never use “admin” as a username. It’s the first guess in every automated attack. Create a new administrator account with a unique username, then delete the original admin account.
Enforce Strong Passwords
WordPress has built-in password strength requirements. Use them. For client sites, we require:
- Minimum 12 characters
- Mix of uppercase, lowercase, numbers, and symbols
- No dictionary words or common patterns
- Password managers for all team members
Enable Two-Factor Authentication
This is the single most effective security measure you can implement. Even if credentials are compromised, attackers can’t access the account without the second factor.
We recommend app-based 2FA (Google Authenticator, Authy) over SMS. SMS can be intercepted through SIM swapping attacks.
Limit Login Attempts
WordPress allows unlimited login attempts by default. A plugin like Limit Login Attempts Reloaded blocks IP addresses after failed attempts. Set it to lock out after 3-5 failed attempts for 30 minutes.
Web Application Firewalls Block Attacks Before They Reach WordPress
A Web Application Firewall (WAF) filters malicious traffic before it hits your server. Wordfence reports blocking over 215 million malicious requests daily—and that’s just their users.
There are two approaches:
Cloud-Based WAF (Cloudflare, Sucuri)
Traffic routes through their servers first. Malicious requests never reach your site. This also provides DDoS protection and can improve performance through caching.
Downsides: Monthly cost ($9-$200+/month depending on features). Adds a layer of complexity to your infrastructure.
Plugin-Based WAF (Wordfence, Shield Security)
Runs on your server. Can perform deeper scans and integrates directly with WordPress. Wordfence’s free tier is surprisingly capable.
Downsides: Uses your server resources. Large sites may see performance impacts during scans.
For most small to medium business sites, we start with Wordfence’s free version. It provides firewall protection, malware scanning, and login security in one package. If a site needs enterprise-grade protection or handles sensitive data, we add Cloudflare’s WAF on top.
File Permissions Matter More Than You Think
Incorrect file permissions can let attackers modify your files even if they can’t log in. The official WordPress documentation recommends:
- Directories: 755 (owner can read, write, execute; others can read and execute)
- Files: 644 (owner can read and write; others can only read)
- wp-config.php: 600 or 640 (only the owner can read and write)
Never use 777 permissions. Ever. This gives everyone full access to modify files.
The wp-config.php file deserves special attention. It contains your database credentials and security keys. Some hosts allow you to move this file one directory above your web root, making it inaccessible via web browsers entirely.
Backups Are Your Last Line of Defense
Security measures reduce risk. They don’t eliminate it. A current, tested backup is the only way to guarantee recovery from a successful attack.
Our backup requirements:
- Daily backups for the database (posts, orders, user data)
- Weekly backups for full site files
- Off-site storage — Not on the same server as your site. If the server is compromised, so are local backups.
- Tested restoration — A backup you’ve never tested isn’t a backup. It’s a hope.
We use UpdraftPlus for most client sites, configured to store backups on a separate cloud storage account (Google Drive, Dropbox, or Amazon S3). For WooCommerce stores, we increase database backups to every 6 hours during peak sales periods.
The 2026 Threat Landscape Has Changed
The security measures above are foundational. But 2026 brings new concerns that most guides haven’t caught up with.
Supply Chain Attacks
In July 2025, the popular Gravity Forms plugin was compromised at the source. Users who downloaded version 2.9.11.1 from the official site received malware. This wasn’t a vulnerability—the attackers compromised the developer’s build system.
What this means for you:
- Be cautious with plugins from developers who’ve had security incidents
- Wait 24-48 hours before applying major plugin updates (early adopters become unwitting testers)
- Monitor security news sources like Wordfence’s blog or SolidWP’s vulnerability reports
AI-Powered Attacks
Automated scanners can now identify and exploit vulnerable WordPress sites in minutes. AI-driven botnets can bypass traditional CAPTCHAs and generate contextually aware phishing attempts.
The defense: behavior-based analysis over rule-based detection. Modern security plugins are adapting, but this is an evolving arms race.
EU Cyber Resilience Act (September 2026)
If you do business in the EU or with EU customers, this matters. By September 2026, software developers—including plugin and theme authors—must notify authorities and users about actively exploited vulnerabilities. Plugins that don’t comply may need to be removed from sites serving EU users.
This will likely accelerate the consolidation of the plugin ecosystem. Smaller, unmaintained plugins will become even riskier.
Security Is Ongoing, Not One-Time
The most common mistake we see? Treating security as a setup task rather than an ongoing process.
A secure WordPress site requires:
- Weekly: Review security scan results, apply plugin updates on staging
- Monthly: Review user accounts, check file permissions, verify backups are running
- Quarterly: Full security audit, review hosting environment, update security policies
This is exactly what our WordPress maintenance plans cover. But whether you handle security in-house or work with a partner, the key is that someone is actually doing it—consistently.
What to Do Next
If you haven’t reviewed your site’s security recently, start with the plugin audit. Delete what you don’t need. Update what remains. Enable two-factor authentication for all admin accounts.
These three steps alone eliminate the majority of common attack vectors.
For sites handling e-commerce transactions, customer data, or business-critical operations, a professional security audit makes sense. We offer free website audits that include a security assessment—not a sales pitch, just an honest look at where your site stands.
Security isn’t about being paranoid. It’s about being prepared.