WordPress security: what gets sites hacked and what protection costs (2026)

What actually gets WordPress sites hacked

Most WordPress hacks don’t start with a genius attacker. They start with old software, a weak password, or a plugin nobody updated. WordPress’s own hardening guide says hacks are “most often attributed to the application itself,” meaning WordPress and the add-ons running on it, not the data center.

The same guide explains why updates matter so much. “Older versions of WordPress are not maintained with security updates,” and once a fix ships, “the information required to exploit the vulnerability is almost certainly in the public domain.” In other words, the day a patch comes out is the day attackers learn where to look.

Plugins are where the holes are

Patchstack, a security company that sells virtual patching (so read its numbers as vendor-published data), counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, according to its State of WordPress Security in 2026 report. Its breakdown:

• 91% were in plugins.
• 9% were in themes.
• Only 6 were reported in WordPress core.
• 46% had no fix from the developer in time for public disclosure.

That last number is the uncomfortable one. Updating is necessary, but some holes are public before any update exists. That’s the gap a firewall with fresh rules tries to cover.

Stolen or guessed logins

The second big door is your login. The hardening guide asks for long, randomly generated passwords and two-step authentication on top. WordPress.org’s hacked-site FAQ even tells owners to scan their own computer, because attackers may have stolen login details from it.

The server under your site

Your host matters too. The hardening guide warns that on shared web hosting, “your website can potentially be compromised too even if you follow everything in this guide.” The software on the server, such as PHP, needs updates like WordPress does. Our news post on the PHP2Shell flaws is a recent example of why your host’s update habits count.

The free basics: do these first

These steps cost nothing and close most of the doors above. We build on WordPress every week, and this list is the routine, not the extras: updates and backups do more than any paid plugin.

1. Turn on updates. Keep WordPress current (automatic core updates have existed since version 3.7, per the hardening guide) and turn on auto-updates for plugins you trust.
2. Delete what you don’t use. The hardening guide says to remove unused plugins. Do the same with spare themes. Back up first, then deactivate each one before you delete it.
3. Install only from trusted sources. Get WordPress from wordpress.org, and plugins and themes from the WordPress.org directory or the vendor’s own site. Never install a “free” copy of a paid plugin.
4. Use a password manager and two-factor login. Long random passwords for WordPress, your hosting account, SFTP and the database, plus two-factor on admin accounts.
5. Keep dated backups somewhere else. The hardening guide asks for regular backups and several dated snapshots, so you have a copy from before any break-in. See our guide to WordPress backup plugins and the website backups glossary entry.
6. Use HTTPS. A free SSL certificate protects logins in transit. Most hosts include one.
7. Turn off the built-in code editor. Adding DISALLOW_FILE_EDIT to wp-config.php stops anyone with admin access from editing plugin and theme code in the dashboard. Back up first.
8. Ask your host about the PHP version and file permissions. The guide suggests 755 for folders, 644 for files, and 400 or 440 for wp-config.php.
9. Add Google Search Console. It’s free and it emails you if Google finds malware or hacked content. Our Search Console guide covers setup.

Two kinds of firewall

A web application firewall, or WAF, filters bad requests before they reach the code they’re trying to break. Security tools put it in one of two places:

• Inside WordPress. Wordfence, Kadence Security and Jetpack run as plugins on your server. They see a lot about your site but still use your server’s resources.
• In front of your server. Cloudflare and Sucuri’s firewall sit between visitors and your host, as a reverse proxy. You switch your DNS to send traffic through them first. The hardening guide names Cloudflare and Sucuri as examples of this setup.

A cloud firewall stops attacks earlier, and it adds a CDN. But it doesn’t clean malware that’s already on your server. Plenty of sites use one of each.

WordPress security plugins compared

Prices below come from each vendor’s own pages, in US dollars before tax, for one site.

Wordfence

Wordfence has 5+ million active installs on WordPress.org. The free plugin includes a firewall, malware scanner, brute-force protection and two-factor login, but firewall rules and malware signatures reach free users 30 days late. Premium removes that delay for $149 a year, per Wordfence’s plans page. Care ($590 a year) and Response ($1,250 a year) add people: an analyst, a yearly audit, and incident response that covers malware removal, blocklist removal and SEO cleanup. Response promises a 1-hour response time, around the clock.

Right for: most WordPress owners who want one plugin. The free version is a sensible start; Premium makes sense when a 30-day-old rule feels too slow.

Sucuri

Sucuri sells two things, per its signup page. Firewall plans ($9.99 or $19.98 a month) put a cloud WAF and CDN in front of your site. Platform plans ($229, $339 or $549 a year) add monitoring and unlimited malware and hack removal, with cleanup response times of 30, 12 and 6 hours. Sucuri says multi-year signups get up to 30% off. It works with any site, not only WordPress.

Right for: owners who want cleanup bundled in, or one firewall in front of several kinds of sites.

Kadence Security, formerly Solid Security

Check the name before you search. The plugin once called iThemes Security became Solid Security, and its WordPress.org page now calls it Kadence Security, with 700,000+ installs. The free Basic version covers two-factor login, password rules, brute-force protection, file change detection and a site scanner (four scans a day). Liquid Web’s Kadence add-ons page says the Pro version is “Included with Pro & Elite” bundles, but we couldn’t find a standalone Pro price.

Right for: owners who want login protection and two-factor without a heavy scanner, and sites already on Kadence.

Jetpack Security

Jetpack Security, from Automattic, bundles real-time cloud backups (10 GB to start), malware scanning with one-click fixes, a firewall and Akismet spam protection. It costs $9.95 a month billed yearly for the first year, and the product page says “all renewals are at full price,” which is $19.95 a month.

Right for: owners who want backups and security from one company and don’t want to set up storage.

Cloudflare

Every Cloudflare plan, including Free, lists unmetered DDoS protection and the Free Managed Ruleset. Pro ($20 a month billed annually, $25 billed monthly) adds the Cloudflare Managed Ruleset and the OWASP Core Ruleset, per Cloudflare’s WAF docs.

Right for: almost any site as a free first layer, if you’re comfortable moving your DNS.

What your host may already include

Read your plan before you buy anything. Some hosts cover scanning, and a few cover removal:

• Bluehost lists “Free Malware Scanning” on all shared plans, malware detection and removal, and a web application firewall on Business and eCommerce Essentials, per its shared hosting page.
• SiteGround mentions “daily malware scans with free removal,” a web application firewall, AI anti-bot protection and a free pre-installed Security Optimizer plugin. Its separate Site Scanner add-on is extra (Premium adds one-click cleanup), and the price shows only in the Client Area. Ask support what the free removal covers on your plan.
• Hostinger says its web and cloud hosting plans include a malware scanner, with a paid Site Cleanup service for $95, per its help article.

Our web hosting hub compares the hosts’ full prices and renewals.

What security costs over 3 years

We start from the same baseline we use across the site: WordPress on Bluehost Starter ($3.99 x 36 = $143.64), a domain after the free first year ($36.96) and one Google Workspace inbox ($252). That’s $432.60 for 3 years before any security tool. Paid prices assume today’s yearly price each year, since most vendors don’t print a separate renewal price.

Two things stand out. A free setup done well costs nothing extra. And Jetpack Security’s price doubles after year one: $119.40 the first year, then $239.40 a year. Sucuri’s multi-year discount could lower its line, but the exact amount isn’t shown.

Which setup fits which site

• A small business brochure site: the free basics, a free security plugin, off-site backups and Search Console. Add Cloudflare Free if you can manage DNS.
• A store or a site that takes logins: consider real-time rules (Wordfence Premium or a cloud WAF). Patchstack found that 46% of new holes had no fix in time for public disclosure, and a fresh firewall rule is the only cover in that gap.
• Nobody on your team wants to handle a hack: pay for a plan with cleanup included, such as a Sucuri Platform plan or Wordfence Care, or check what your host’s plan covers.

Hosted builders work differently. On Wix or Squarespace, the platform runs the servers and software, so there are no plugins to update. Your job is the account: a strong password and two-factor login.

Don’t stack two security plugins that both run a firewall and scanner. Two tools doing the same job can conflict, and both use your server. Pick one plugin, and add a cloud firewall in front if you want a second layer.

What to do next

• Work through the free basics list above this week.
• Set up backups you can restore: WordPress backup plugins compared.
• If something already looks wrong, follow our hacked website guide.
• Security plugins and caching plugins share a server, so read our WordPress speed guide before adding both.
• New to self-hosted WordPress? Start with our WordPress review.