Do You Need a Security Plugin on WordPress? Print

The short answer

Yes, in some form. WordPress is the most-targeted website platform in the world, simply because it runs so much of the web, and a WordPress site with no security measures at all is a soft target. But "a security plugin" is only part of the answer, and buying one and forgetting about it can even give you a false sense of safety. This article explains what security actually protects you, where a plugin fits, and how to think about it honestly.

What actually keeps a WordPress site safe

Security is layers, not a single product. In rough order of importance:

• Keeping everything updated. This is the big one. The overwhelming majority of hacked WordPress sites are broken into through outdated core, themes, or plugins, as our article on hacked sites explains. No security plugin makes up for neglected updates, so updating, covered in our article on updating WordPress safely, is the foundation everything else sits on.
• Strong, unique passwords, on your WordPress admin, your hosting, and your email, the theme that runs through all our security articles.
• Server-level protection, which on our hosting you already have: firewalls, malware scanning, and brute-force protection working at the server, beneath WordPress, on every site we host.
• A security plugin, which adds WordPress-specific protection on top: login protection, file-change monitoring, a firewall tuned for WordPress, and alerts when something looks wrong.

A security plugin is a genuine and worthwhile layer. It is just not a substitute for the layers beneath it, and anyone who sells it as "install this and you are safe" is overselling it.

What a security plugin does well

• Protects your login, limiting failed attempts and blocking the automated password-guessing that every WordPress site attracts.
• Watches your files, alerting you when something changes unexpectedly, which is often the earliest sign of a compromise.
• Adds a WordPress-aware firewall, filtering malicious requests before they reach your site.
• Scans for known malware and vulnerabilities, and warns you about them.

For a business site, and especially an online store, that is real value. The catch is the same as with any plugin: it has to be properly configured and kept updated to be worth anything, and a security plugin installed on its defaults and never looked at again is doing a fraction of its job.

The honest catch, and where we come in

Here is the tension. A security plugin needs setup, maintenance, and someone to actually act on its alerts, and if your plugins are not kept updated, no security plugin can protect you anyway. So the real question is not "should I install a security plugin," it is "who is going to keep this site genuinely secure."

If that is you, and you will keep everything updated and act on what the plugin tells you, then yes, install a reputable one and maintain it. If you would rather that whole burden were handled, that is exactly what our WP Security Manager service is for: we install and maintain a professional security plugin, keep your core and plugins updated, and if the site is ever compromised while subscribed, we clean it, at no per-incident charge. Our article on WP Security Manager covers it in full. It exists because a security plugin is only as good as its upkeep, and upkeep is the part people run out of time for.

Good to know

The most important security measure is not a plugin at all, it is keeping your site updated, so if you do only one thing, do that. A security plugin is a strong second layer for a business or a store, well worth having, provided it is set up properly and maintained rather than installed and forgotten. And the genuine question underneath all of it is time: security is not a purchase, it is a habit, and if the habit is one you would rather not carry, talk to us about having it handled instead. A site that is actually maintained beats a site with an impressive plugin nobody is watching, every time.