# WordPress security, checked, not assumed.

> WordPress security without the hype: what security plugins do and don't, backups that work, updates and monitoring. Start with a free external scan.

URL: https://webintacta.com/en/wordpress-security
Language: English (Spanish version: see the hreflang alternate of the HTML page)
Last updated: 2026-10-24

**In short:** A secure WordPress site depends less on the security plugin than on having few plugins, all updated, backups stored off the server and no admin accounts that shouldn't be there. At WebIntacta I (Jose Soriano) check it with a free external scan, fix the urgent issues with the report + hardening service (€299) and keep it that way with the Business website plan (€35/month, no lock-in), excluding VAT.


Almost every hacked WordPress site I have seen had a security plugin installed. The problem is rarely a missing plugin; it is an outdated component, a user who shouldn't be there or a forgotten file left in plain sight. Here I bring together what actually protects a WordPress site and where each guide is.

## What I check on a WordPress site

- WordPress, plugin and theme versions against vulnerability databases
- Abandoned plugins or "nulled" copies
- Admin users, default passwords and access to `wp-login.php` and `xmlrpc.php`
- Exposed files: `.zip` backups, `wp-config.php.bak`, debug logs
- Core integrity: every file compared with the original
- Security headers, HTTPS and the domain's email (SPF, DKIM, DMARC)

## How I do it

1. **External scan, free.** In a few minutes you see the grade and what anyone can see from outside.
2. **Hardening.** I apply pending updates, remove plugins and users that shouldn't be there, close exposed files and set up backups and headers.
3. **Monitoring.** I leave it on maintenance with a weekly scan, a daily backup and an alert if the site goes down. If it gets infected, the cleanup is included.

## WordPress security, piece by piece

## Security plugins: what they do and what they don't

A good security plugin adds an application firewall, limits login attempts, alerts you to changed files and looks for known malware signatures. It is useful. What it doesn't do: update the vulnerable plugin for you, know which user shouldn't be there, go through the database thoroughly or tell you how someone who is already inside got in.

One well-known, well-maintained plugin is enough; two at once tend to get in each other's way. The comparison is in [which is the best WordPress security plugin](https://webintacta.com/en/guides/best-wordpress-security-plugin). If you are torn between a plugin, a paid service or having someone take care of it, it is laid out with sources in the [comparison: Wordfence, Sucuri or a technician](https://webintacta.com/en/compare).

## Backups

A backup is only useful if it meets three conditions: it is stored off your server, it is from before the infection and someone has tested restoring it. The copy your hosting provider keeps on the same machine fails the first one. How to set them up properly, in the [WordPress backup guide](https://webintacta.com/en/guides/wordpress-backup).

## Updates and headers

Plugin flaws are published and exploited within days, so updates happen every week, with a backup first. The dashboard showing nothing pending is not enough: a closed or abandoned plugin, or one with an expired license, won't tell you. How to check it, in [vulnerable WordPress plugins](https://webintacta.com/en/guides/vulnerable-wordpress-plugins). For logins (passwords, two-factor authentication and `xmlrpc.php`), there is the guide on [WordPress brute-force attacks](https://webintacta.com/en/guides/wordpress-brute-force-xmlrpc). Security headers (HSTS, CSP, X-Frame-Options) cost little and shut down whole classes of attacks: they are explained in [HTTP security headers](https://webintacta.com/en/guides/http-security-headers).

If you want a full review from the inside, with a PDF and an action plan, that is the [website security audit](https://webintacta.com/en/website-security-audit). If you have already been hacked, go straight to [WordPress malware removal](https://webintacta.com/en/wordpress-malware-removal).

## Price

The scan is free. Report + hardening fixes the urgent issues; maintenance keeps it that way, with no lock-in.

### External scan — Free
Security grade and the problems visible from the internet, in a few minutes and with no sign-up.
- Platform and version (WordPress, PrestaShop, WooCommerce, Shopify…)
- Visible plugins and modules with published flaws
- Files that should not be public (backups, .git, configuration files)
- HTTPS, certificate and security headers
- Domain email (SPF, DKIM, DMARC) and blocklists
- AI agent readiness (scored separately)

### Report + hardening — €299 (excluding VAT)
The security report and the fix of what is urgent (up to 3 hours).

$299 outside the EU.
- Full security report
- Fix of the urgent findings, up to 3 hours of work
- A new scan to confirm it

> Tienda online: 389 € (389 US$ en Latinoamérica).

### Maintenance · Business website — €35/month (excluding VAT)
WordPress or company website: kept up to date, backed up and monitored.

$29/month outside the EU.
- Supervised updates of core, plugins and theme, with a backup first
- Daily backup stored off your server
- Weekly security scan
- Downtime alert (checked every 5 minutes)
- Monthly PDF report
- One cleanup a year included if it gets infected (from the 3rd month)

> No minimum term. Annual payment: 10 months.

**+ Priority add-on: +€25/month** (+$19/month outside the EU). Your issues go to the front of the work queue and, if you get hacked, the cleanup gets priority at no extra cost.

Outside the EU, the scan is just as free and, if you want it, the maintenance plan costs $29/month.

## Frequently asked questions

### How do I know if my WordPress site is secure?

Start with the [free external scan](https://webintacta.com/en/free-website-security-scan): it shows the grade and what anyone can see from outside (versions, vulnerable plugins, exposed files, headers). What it can't see from outside (core integrity, users, the database) is covered by the inside report.

### Which security plugin do you recommend?

For most sites, one well-known, well-maintained plugin (with a firewall and a limit on login attempts) is enough. More important than which one: having few plugins, all updated, and nobody with admin rights who doesn't need them. I explain it in the [security plugin guide](https://webintacta.com/en/guides/best-wordpress-security-plugin).

### How often should I check security?

Updates, every week: flaws are published and exploited within days. A full review at least once a year, or after any big change.

### How do I know if my WordPress site is already hacked?

There are signs you can check yourself: users you don't know, .php files in `uploads`, redirects on mobile. They are all in [how to tell if my WordPress site is hacked](https://webintacta.com/en/guides/how-to-tell-if-wordpress-is-hacked).

### Does it work for WordPress multisite?

Yes, although each site in the network is checked separately and the cleanup carries a €90 surcharge.

Hire or ask (email and chat): https://webintacta.com/soporte?lang=en