In short
A secure WordPress site depends less on the security plugin than on having few plugins, all updated, backups stored off the server and no admin accounts that shouldn't be there. At WebIntacta I (Jose Soriano) check it with a free external scan, fix the urgent issues with the report + hardening service (€299) and keep it that way with the Business website plan (€35/month, no lock-in), excluding VAT.
Reviewed by Jose Soriano ·
Almost every hacked WordPress site I have seen had a security plugin installed. The problem is rarely a missing plugin; it is an outdated component, a user who shouldn't be there or a forgotten file left in plain sight. Here I bring together what actually protects a WordPress site and where each guide is.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.
STEP 01
In a few minutes you see the grade and what anyone can see from outside.
STEP 02
I apply pending updates, remove plugins and users that shouldn't be there, close exposed files and set up backups and headers.
STEP 03
I leave it on maintenance with a weekly scan, a daily backup and an alert if the site goes down. If it gets infected, the cleanup is included.
A good security plugin adds an application firewall, limits login attempts, alerts you to changed files and looks for known malware signatures. It is useful. What it doesn't do: update the vulnerable plugin for you, know which user shouldn't be there, go through the database thoroughly or tell you how someone who is already inside got in.
One well-known, well-maintained plugin is enough; two at once tend to get in each other's way. The comparison is in which is the best WordPress security plugin. If you are torn between a plugin, a paid service or having someone take care of it, it is laid out with sources in the comparison: Wordfence, Sucuri or a technician.
A backup is only useful if it meets three conditions: it is stored off your server, it is from before the infection and someone has tested restoring it. The copy your hosting provider keeps on the same machine fails the first one. How to set them up properly, in the WordPress backup guide.
Plugin flaws are published and exploited within days, so updates happen every week, with a backup first. The dashboard showing nothing pending is not enough: a closed or abandoned plugin, or one with an expired license, won't tell you. How to check it, in vulnerable WordPress plugins. For logins (passwords, two-factor authentication and xmlrpc.php), there is the guide on WordPress brute-force attacks. Security headers (HSTS, CSP, X-Frame-Options) cost little and shut down whole classes of attacks: they are explained in HTTP security headers.
If you want a full review from the inside, with a PDF and an action plan, that is the website security audit. If you have already been hacked, go straight to WordPress malware removal.
The scan is free. Report + hardening fixes the urgent issues; maintenance keeps it that way, with no lock-in.
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
Free
No sign-up, no commitment
The security report and the fix of what is urgent (up to 3 hours).
€299
excluding VAT$299 outside the EU
WordPress or company website: kept up to date, backed up and monitored.
€35/month
excluding VAT$29/month outside the EU
Outside the EU, the scan is just as free and, if you want it, the maintenance plan costs $29/month. All prices
Guides
Start with the free external scan: it shows the grade and what anyone can see from outside (versions, vulnerable plugins, exposed files, headers). What it can't see from outside (core integrity, users, the database) is covered by the inside report.
For most sites, one well-known, well-maintained plugin (with a firewall and a limit on login attempts) is enough. More important than which one: having few plugins, all updated, and nobody with admin rights who doesn't need them. I explain it in the security plugin guide.
Updates, every week: flaws are published and exploited within days. A full review at least once a year, or after any big change.
There are signs you can check yourself: users you don't know, .php files in uploads, redirects on mobile. They are all in how to tell if my WordPress site is hacked.
Yes, although each site in the network is checked separately and the cleanup carries a €90 surcharge.
Free external scan. No sign-up and nothing to install.
Data protection. Controller: Jose Soriano Castro. Purpose: to send you the diagnostic PDF, email you for 30 days if a security flaw affecting your site is published (with a follow-up scan on day 30) and reply in writing to your question; offers only if you tick that box. Legal basis: your consent. Recipients: nobody, unless required by law. You can unsubscribe at any time with the link in every email or by writing to me. Rights: access, rectification, erasure, objection, restriction and portability. Privacy policy.