Most articles on this subject list ten plugins, describe each one as comprehensive, and leave you with the impression that installing the right one makes you safe.
It doesn’t, and starting there will cost you money. So before the plugin recommendations, the part that actually determines whether your site gets hacked.
Almost Every WordPress Hack Is Boring
Nobody is targeting your business specifically. The overwhelming majority of compromised WordPress sites are found by automated scripts crawling the entire internet, looking for one thing: a known vulnerability in an out-of-date plugin or theme.
The sequence is almost always the same. A plugin ships a security fix. The fix is published, which means the vulnerability it fixes is now public. Bots immediately start scanning for sites that haven’t applied it. Sites that took three months to update get found.
That’s it. That’s how it happens. Not a determined attacker, not a clever exploit — an unpatched plugin and a script.
Which leads somewhere inconvenient for an article about security plugins:
- Keeping WordPress, themes and plugins updated prevents most of what actually happens
- Decent hosting prevents a good chunk of the rest, before a request ever reaches WordPress
- A security plugin catches some of what’s left, and gives you warning when something’s wrong
A security plugin on a site that hasn’t been updated in a year is a smoke alarm in a burning building. Useful, but you’ve missed the point.
What a Security Plugin Is Actually For
Given the above, the genuinely valuable jobs are:
- Telling you a plugin you use has a known vulnerability, ideally before you’d have noticed
- Blocking brute-force login attempts, which are constant and noisy
- Two-factor authentication on admin accounts
- Scanning for changed or injected files, so a compromise gets caught in days rather than when a customer tells you
- A firewall, filtering obviously malicious requests
Note what’s missing: nothing on that list protects a site running a plugin with a six-month-old critical vulnerability. That’s still on you.
The Ones Worth Considering
Wordfence
The most widely installed, and a reasonable default. Firewall, malware scanning, login protection and two-factor in one package, with a free tier that’s genuinely useful. The firewall runs inside WordPress rather than in front of it, which means a request has already reached your server before it’s evaluated — less efficient than a proper edge firewall, and fine for most small sites.
Its one real cost is resource usage. Scans on a busy site on cheap shared hosting can be noticeable.
Patchstack
The one I’d point most people at if they only install one thing, because it does the job that matters most: it tracks known vulnerabilities in the specific plugins and themes you have installed, and tells you when one is affected. That’s the exact failure mode that causes most hacks, addressed directly.
Lighter than the all-in-one scanners, and a different philosophy — prevention and intelligence rather than scanning for damage after the fact.
Solid Security
Formerly iThemes Security, renamed after the SolidWP rebrand, so older articles still referring to iThemes are talking about this. Good two-factor implementation, sensible hardening defaults, and login protection. A solid all-rounder without Wordfence’s resource appetite.
Sucuri
Best known for its firewall, which — unlike Wordfence’s — sits in front of your site at the DNS level, filtering traffic before it reaches your server. That’s the architecturally better approach, and it’s the paid product. The free plugin does file integrity monitoring and activity auditing, which is worth having on its own.
Sucuri’s other draw is that their paid plans include cleanup if you do get hacked. If you’ve been compromised before, that’s worth real money.
WP Fail2Ban
Narrow and excellent at its one job: it logs failed logins to the server’s system log so fail2ban can block offending IPs at the firewall, before they reach PHP at all. Needs server access to set up, so it’s not for everyone, and it’s the most efficient way to deal with brute-force traffic when you have it.
Ones to Be Careful With
Don’t install two. Running Wordfence and Solid Security together doesn’t double your protection. It creates conflicts, duplicate login blocking that can lock you out of your own site, and a genuine performance cost. Pick one all-rounder. Patchstack alongside it is fine, because it does a different job.
Check what your host already does. Managed WordPress hosts increasingly include firewalling, malware scanning and automatic core updates. If yours does, a heavyweight security plugin is duplicated effort and duplicated overhead.
Be sceptical of abandoned plugins. A security plugin that hasn’t been updated in two years is worse than no plugin — it’s a dependency with its own attack surface and nobody maintaining it. Several of the recommendations that circulate in older listicles fall into this category now. Check the last-updated date before installing anything.
The Free Things That Matter More
None of these need a plugin, and all of them beat one:
Update things. Weekly, not annually. Enable automatic updates for minor core releases at minimum. If you won’t do it, pay somebody to — it costs less than a cleanup.
Delete what you don’t use. Deactivated plugins and unused themes still sit on your server and can still be exploited. Deactivated isn’t removed. Delete them.
Real backups, stored off the server. The single most valuable security measure there is, because it turns a catastrophe into an afternoon. A backup sitting on the same server as the site it’s backing up is not a backup.
Strong, unique admin passwords and two-factor. Most “hacks” of small sites are a reused password from an unrelated breach.
Don’t use “admin” as a username. Free, takes a minute, removes half of every brute-force attempt.
Keep PHP current. Old PHP versions stop getting security patches. Plenty of sites are running versions that haven’t been supported for years because nobody ever changed it.
So What Should You Install?
For most small business sites:
- One all-rounder — Wordfence or Solid Security, not both
- Patchstack alongside it, for vulnerability intelligence on what you actually run
- A real backup solution storing copies somewhere other than your web server
- Two-factor on every administrator account
Then update everything regularly, because that’s the part that actually decides it.
If keeping on top of that isn’t realistic alongside running your business, that’s exactly what ongoing website management covers — updates, backups, monitoring and patching handled so it doesn’t depend on you remembering. And if you think your site may already be compromised, get in touch and I’ll take a look.
