In brief

Plugins, not WordPress itself, are where the risk sits: of the 11,334 vulnerabilities recorded across the ecosystem in 2025, 91% were in plugins and six were in core. So the work is choosing plugins you can trust, keeping them updated, and hardening logins and file permissions underneath whichever security plugin you run.

On this page ▾

WordPress runs a large proportion of the web, which makes it a consistent target. Attackers do not usually go after specific sites. They run automated scans across millions of installations, looking for known vulnerabilities, outdated software and weak credentials. Understanding where the risk actually comes from is the starting point for defending a WordPress site properly.

This guide covers the plugin ecosystem as the primary risk vector, the security plugins worth using, and the hardening steps that work regardless of which plugin you install.

Why plugins are the main risk vector

Patchstack’s State of WordPress Security in 2026 recorded 11,334 new vulnerabilities across the WordPress ecosystem during 2025, a 42% increase on the year before. The distribution is the part worth internalising: 91% were in plugins, 9% in themes, and six were in WordPress core, all of them rated low risk.

That is the whole argument in one statistic. Core is not your problem. WordPress core is maintained by a large security team and patched quickly. Plugins vary enormously in maintenance quality, and there are over 64,000 of them in the official directory alone.

Attackers exploit plugins in several ways. Some target upload functions to inject malicious files. Others use plugin flaws to carry out cross-site scripting (XSS) attacks, inserting code into pages your visitors see. The most serious allow full site takeover, and those are not rare or historical: 2026 has already seen several critical flaws in plugins with six-figure install counts exploited in the wild within days of disclosure. The pattern to take from that is not which plugin was hit, it is how little time you get between a patch landing and attackers using it.

One assumption worth dropping: paid does not mean safer. Premium and freemium components accounted for 29% of Patchstack’s valid reports, and 76% of the vulnerabilities found in premium components were exploitable in real-world attacks.

Abandoned plugins: a specific risk

A plugin with no update in two years or more is effectively abandoned. No updates means no security patches and no response when a flaw is found. Attackers target abandoned plugins specifically, because they know the code will not be fixed. You can check any plugin’s status on its WordPress.org directory page, where the last updated date and active installation count are both listed.

An abandoned plugin is not necessarily broken today. The longer it goes unmaintained, the higher the odds that an unpatched flaw is found and exploited. Removing them is low effort and high value.

The update advice everyone gives, and why it is incomplete

Every WordPress security guide tells you to keep everything updated. That advice is correct and it is not sufficient, for two reasons that rarely appear in the same articles.

Nearly half of disclosed vulnerabilities have no fix available. Patchstack found that 46% of vulnerabilities did not receive a developer patch in time for public disclosure. When a flaw goes public without a fix, updating is not an option that exists. You are exposed until the developer responds, and sometimes they never do.

The window is measured in hours, not weeks. Around half of high-impact vulnerabilities are exploited within 24 hours of disclosure, and the most heavily targeted are hit within roughly five hours. Automated update checks that run daily are not fast enough to help in that window.

This is what actually justifies running a firewall rather than relying on patching. A firewall can block an exploit pattern before a patch exists, which is the only defence available during the gap. Updating closes the vulnerability; a firewall covers the period when you cannot.

Choosing plugins you can trust

The WordPress plugin directory is the safest source, since everything listed there is reviewed before publication. For plugins from elsewhere, these checks are worth running before installing.

  • Find the developer’s website. No credible web presence is a warning sign. Legitimate developers are identifiable.
  • Check the marketplace. CodeCanyon is one of the main third-party marketplaces and vets submissions before listing. A paid plugin on neither a recognised marketplace nor an identifiable developer site deserves caution.
  • Look at install count and last updated date together. A plugin available for years with very few installs warrants scrutiny. Low adoption plus infrequent updates suggests limited active maintenance.
  • Search the WPScan Vulnerability Database. Check wpscan.com for the plugin before installing. If a vulnerability is listed and no update is available, do not install it.

Tip: Do not run two security plugins at once. Running multiple security tools in parallel can conflict, produce duplicate alerts and in some cases block legitimate traffic. Pick one and configure it properly.

WordPress security plugins worth using

Three plugins stand out for reliability, active development and the range of threats they cover. Each takes a genuinely different approach, so the right choice depends on what you need most. All three have a free tier adequate for most personal and small business sites.

Wordfence Security

Wordfence is one of the most widely installed. Its core feature is a web application firewall that filters malicious traffic before it reaches WordPress, paired with a malware scanner that compares your core files, themes and plugins against known-clean versions and flags anything that does not match.

The free tier covers the essentials: firewall, malware scanning, login protection, rate limiting and live traffic monitoring. You can block specific IP addresses from the dashboard, and the login lockdown feature limits repeated failed attempts to blunt credential stuffing.

One limitation matters more than it first appears. The free tier receives new firewall rules on a 30-day delay compared to Wordfence Premium. Given that half of high-impact vulnerabilities are exploited within 24 hours, that delay lands squarely in the window the firewall exists to cover. For a personal blog the free version is reasonable. For anything processing payments or holding customer data, the premium tier is what closes that gap.

Solid Security (formerly iThemes Security)

Solid Security takes a hardening-first approach. Rather than centring on a firewall, it works through a checklist of configuration changes that reduce your attack surface: changing the database table prefix away from the default wp_ that automated attacks target, moving the login page to a custom URL, disabling the file editor and enforcing strong passwords across all accounts.

Two-factor authentication (2FA) is in the free version, which is among the most effective single steps available for protecting admin accounts. File integrity monitoring alerts you when core or PHP files change unexpectedly, often the earliest signal of a compromise. The interface explains what each setting does, which makes it a good choice if you want a structured pass through your configuration rather than trusting defaults.

MalCare Security

MalCare differs architecturally from the other two. Its malware scanning runs on MalCare’s servers rather than yours, so the scan does not consume your hosting resources. That matters on shared or resource-limited hosting, where a heavy local scan noticeably slows the site while it runs.

Its standout feature is one-click malware removal. Most free security plugins identify malware but leave cleanup to you or charge for removal; MalCare handles it from the dashboard. It also includes bot protection and login security. If you want detection and removal in one tool without a server-side scan, it is a strong option.

Worth knowing about as a fourth option: All In One Security (AIOS) is free and combines hardening, firewall and login protection in a single dashboard, which suits people who would rather have one tool than a feature-heavy suite.

Hardening steps beyond plugins

No security plugin compensates for an outdated installation, an abandoned plugin or a weak admin password. These steps matter whichever plugin you choose.

Enable auto-updates

Outdated plugins remain the most common route to a compromised WordPress site. In the admin, go to Plugins > Installed Plugins and enable auto-updates per plugin, then apply the same under Dashboard > Updates for core. Check your active theme as well, since themes receive security patches exactly as plugins do and an outdated theme carries the same exposure.

Remove plugins you are not using

Deactivated plugins are not safe. If the files are on the server, a vulnerability in them can still be exploited. Deactivate and then delete anything you are not actively using. Fewer plugins also means a lighter site, which helps page load times independently of any security benefit.

Tighten the login

WordPress’s default admin username is admin, and automated tools target it specifically. If your site was set up that way, create a new administrator account, then delete the old one. Use a unique password from a password manager on every admin account. Add two-factor authentication, which is the single most effective defence against credential-based attacks because it holds even when the password is known.

Add a firewall layer

Wordfence includes a firewall inside the plugin, which is the simplest route for a WordPress-only site. A cloud firewall such as Cloudflare works at the DNS level and filters traffic before it reaches your server at all, which also absorbs volumetric attacks that a plugin cannot. For the platform-agnostic detail on firewalls, backups and the UK compliance picture, see how to protect your website from hackers and cyberattacks.

Other threats to know about

Plugin vulnerabilities account for most WordPress compromises. They are not the only attack surface.

SQL injection

SQL injection submits database commands through a form field on your site. Where inputs are not properly validated, an attacker can read, alter or delete your database, or insert content into your pages. Keeping WordPress and plugins current is the main defence, since injection flaws in WordPress components are patched quickly once found. A firewall adds a layer by blocking known injection patterns before they reach the database.

Brute force login attacks

Automated bots cycle through username and password combinations against your login URL. The defences layer, and all three plugins above include login lockdown: a long unique password, two-factor authentication, a limit on failed attempts, and a non-default admin username. Any one of these makes an attack harder. Together they make it impractical.

If your site has already been compromised

If you suspect malware, act rather than waiting for confirmation. Signs include admin accounts you did not create, modified files, unfamiliar content in pages, or a warning in Google Search Console. The guide to removing malware from WordPress covers the recovery steps, and MalCare’s one-click removal handles many cases without manual file editing.

Contacting your hosting provider is the step most site owners skip. Your host may be able to restore a clean backup, identify which files changed, and confirm whether the infection reached other sites on the same account. Make that call early rather than after a day of trying to fix it yourself.

Wrapping up

The plugin ecosystem is the largest single risk to a WordPress site, and it is manageable once you stop treating updates as the whole answer. Remove what you are not using, check what you install before installing it, enable auto-updates, and run one properly configured security plugin so that something is watching the site during the window when no patch exists.

That last point is the one worth carrying away. Nearly half of disclosed vulnerabilities have no fix on the day they go public, and the fastest exploits land within hours. A firewall is not belt-and-braces on top of patching. It is the only thing covering the gap that patching cannot reach.

Share this article X Facebook LinkedIn