Approach
First an inventory: WordPress and PHP versions, every plugin and theme, and whether known holes have been reported for them.
Then there are two ways. Either maintain it for good, updates, backups, fewer plugins, a hardened login. Or remove the attack surface altogether: a site with no admin login and no plugins simply offers less to go after.
Forms then run through a small, secured endpoint instead of a plugin.
What drives the effort
- How many plugins there are and how many can be replaced or dropped
- Whether the site will still be edited
- Forms, logins or downloads that need securing
Every quote is preceded by a free conversation.
When it is not worth it
If the site is maintained, gets regular updates and uses only a few widely used plugins, it is no more dangerous than other software. Then a look at the plugin list is enough.
Common questions
- How would we know our site is affected?
Often you would not. Many attacks stay invisible, and the site is quietly misused, for spam or redirects, say. Some attackers use a reputable site to link to their own pages and raise their standing with the search engines. These so-called backlinks are often hidden at the bottom of the page without anyone noticing. Others are after email lists or other data.
- Isn’t a security plugin enough?
It helps, but it is one more plugin that needs maintaining. The simplest defence is reducing the attack surface, for instance with a static site and no login at all. Well-known plugins are simply attacked more often, because finding and exploiting a hole there pays off more, precisely because so many sites are built with them.