Security
Do you need a WordPress security plugin?
14 August 2026 · 6 min read
On this page
Probably yes, with lower expectations than the marketing sets. A security plugin is a useful tool that does four or five specific jobs. It is not a security strategy, and the gap between those two things is where most compromised sites live.
What they genuinely do well
Malware scanning. Comparing your files against known-good copies and known-bad signatures. Genuinely useful, and something you cannot easily do by hand.
File change monitoring. Alerting when core files change unexpectedly. One of the more reliable early warnings available.
Login protection. Rate limiting, lockouts, two-factor. Effective against automated password guessing.
A firewall. Blocking requests matching known attack patterns before they reach WordPress. Narrower than it sounds, but real.
Vulnerability alerts. Telling you a plugin you run has a published flaw. On the paid tiers, usually the fastest feed available.
What they cannot do
Update your plugins. This is the important one. A scanner that tells you three plugins are vulnerable has done its job, and your site is still vulnerable until a person acts. Almost every hacked site we clean had a security plugin installed and alerting.
Decide anything. Is this file change legitimate or malicious? Should this plugin be deactivated while waiting for a fix? Those are judgement calls.
Clean an infection properly. Automated cleaning removes what it recognises. It does not find the entry point, the reinstaller, or the copy hidden outside the WordPress folder — which is why cleaned sites so often reinfect.
Compensate for neglect. No plugin protects a site running eighteen-month-old code.
Which one
Wordfence — the most comprehensive. Scanner, firewall, login protection, live traffic view. Free tier is genuinely useful; vulnerability signatures are delayed 30 days on free. Heavy on resources on small hosting.
Solid Security (formerly iThemes) — lighter, simpler, good defaults. Less visibility, less overhead.
Sucuri — the firewall is the product, and it sits in front of your site at DNS level rather than inside WordPress. The right answer if you want a genuine WAF, and priced accordingly.
Patchstack — vulnerability-focused rather than a general scanner, with virtual patching. Different category, and a good complement rather than a replacement.
Any of these is fine. The choice matters much less than whether anyone acts on what it reports.
Are the paid tiers worth it?
Usually yes for one specific reason: the 30-day delay on vulnerability signatures in Wordfence's free tier is the difference between patching inside the exploitation window and after it. If you rely on the plugin to tell you about vulnerabilities, paying removes the delay that matters most.
Usually no if you are paying for a firewall you could get at server level, or for automated cleaning you should not rely on anyway.
The trap worth naming
A security plugin creates a feeling of coverage that is not proportional to what it does. Installed, green ticks, weekly summary email — it looks handled.
Meanwhile the thing that actually gets sites hacked is an outdated plugin, and the security plugin can only tell you about it. The alert arrives, gets skimmed, and the update still does not happen.
If you only do one thing, update weekly rather than installing a security plugin. If you do two things, do both.
What we run
On client sites: a security plugin for scanning and login protection, a firewall where the site warrants it, and — the part that matters — a person applying updates weekly and acting on what the scanner reports.
That last part is the whole difference. Our free plugin will tell you today whether anything you run has a published vulnerability; acting on the answer is either your job or ours.