Start here
Three ways in,
depending on where you are.
What's covered
What our WordPress
security services include.
Website security services aren't one product you install. They're a set of jobs that have to keep happening, because WordPress, its plugins and the attacks against them change every week. These are the ones we do on every site on a security plan.
The real risks
Where WordPress sites
actually get broken into.
WordPress itself is rarely the problem. The add-ons are. In its State of WordPress Security in 2026 report, Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, and only six of them were in WordPress core.
Plugin or service?
Is a security plugin
enough on its own?
Sometimes, yes. We built a free one, SecureLite, so we're not going to tell you plugins are useless. A good plugin with someone who reads its alerts is real protection. What a plugin can't do is act on what it finds.
| Security plugin alone | Plugin + security service | |
|---|---|---|
| Finding problems | Flags them in the dashboard or by email. | Someone reads every alert and decides what it means. |
| Updates | Tells you an update is waiting. | Tested on a staging copy, then applied to the live site. |
| No patch exists | Reports the vulnerable plugin. | The plugin is replaced, removed or blocked by a firewall rule. |
| After a hack | Lists the infected files it recognises. | Files, database, users and the way in are cleaned and closed, and Google is asked to review the site. |
| Backups | Not usually its job. | Daily backups stored off the server. |
| Best for | A small site with an owner who checks it every week. | A site that brings in leads or sales, where nobody has time to watch it. |
How we work
Security that's tested,
not assumed.
Most website security is judged by a settings screen: the firewall says it's on, the scanner says it's clean. We've cleaned enough hacked WordPress sites to know those screens can be wrong. On one site, a scan for known malware found none of nine hidden backdoors. Comparing every file with WordPress.org's official copies found all nine.
So we work from proof. We check the site from the outside the way an attacker would, compare files with the official releases instead of only hunting for known bad code, and treat "the setting is on" and "the protection works" as two different questions. It's the same idea behind SecureLite, the free security plugin we built: a button that attacks your own site, harmlessly, and reports which protections actually held.
| Assumed security | Tested security | |
|---|---|---|
| Malware | A scan for known bad code comes back clean. | Files compared with the official release, so an unknown backdoor still shows up. |
| Protections | The setting says "on". | Checked that it actually works on your server, not just switched on. |
| Backups | The plugin says a backup ran. | Stored off the server, with restores that actually work. |
| Updates | Applied straight to the live site. | Tested on a staging copy first, then applied. |
| After a hack | Infected files deleted. | Files, database, user accounts and the way in all checked and closed. |
WordPress security audit
A security audit before
anything else.
Every security engagement starts by finding out what state the site is in. A WordPress security audit looks for what's exposed now and for signs that someone is already inside.
From the outside
Exposed software versions, known vulnerabilities, blocklists, spam in Google, the certificate and security headers. No login needed, written findings in one business day.
From the inside
What can't be seen from outside: admin users you don't recognise, file changes, login protection and backups. Quoted as a fixed fee before it starts.
Fix it or keep it
Use the findings with your own developer, have us do the catch-up work as a fixed fee, or move onto a monthly security plan.
Not sure whether you need it? The free WordPress website audit explains exactly what we check and shows an example report.
WordPress security plans
Which plans
include security.
Security isn't sold separately from maintenance, because an unpatched site can't be secured and a secured site still needs patching. Our WordPress security care plans are three of our four maintenance plans, and the fourth covers the basics.
| Plan | Security included | Best for |
|---|---|---|
| Care | Updates, daily off-site backups, uptime and SSL monitoring. No hardening or malware scanning; a hack cleanup is quoted as a fixed fee. | A simple site that just needs someone responsible for it. |
| Care + Secure | Everything in Care, plus hardening, malware scanning, the emergency response target and one hack cleanup a year. | A business site that brings in leads. |
| Store Care | Everything in Care + Secure, plus checkout and payments tested after every update. | Any site that takes payments. |
| Agency | Care + Secure on every client site, white-labelled, with a direct escalation channel. | Agencies with five or more client sites. |
Every plan is month to month with thirty days' notice. The rates are published: see pricing or compare the plans line by line.
Security for your WordPress site
When security can't
wait for a plan.
Any of these? Don't start deleting files. Read what to do first if your WordPress site is hacked, or send us the address for a fixed-fee malware removal quote.
If you're hacked
How recovery works,
and how long it takes.
How long a cleanup takes depends on how deep the infection goes, which is why we look before we quote. The order of the work doesn't change.
Respond and contain
On a security plan, a 2-hour response target in business hours and 4 hours outside them. Without one, a fixed-fee quote within one business day.
Clean and close the way in
Files, database and user accounts cleaned, passwords and keys changed, and the hole the attacker used found and closed so it doesn't happen again.
Warnings lifted
Google is asked to review the cleaned site through Search Console. Its review typically takes from a few days to a few weeks, and we watch the site for anything coming back.
The full step-by-step is in our guide to what to do when your WordPress site is hacked.
Proof, not promises
All case studies →WordPress backdoor cleanup
Nine disguised PHP files, seven fake administrators and a login token in the database, found by checking every file against WordPress.org's official copies.
Read the case study HundredsSpam pages removed at the sourceJapanese keyword hack
Hundreds of injected spam pages removed from the database and files, the site locked down, and Google asked to re-crawl.
Read the case study AI scanFound what a manual search missedFake CAPTCHA malware
A fake Google CAPTCHA locked every visitor out. A manual search missed the script; an AI-assisted scan found it.
Read the case study 13Attack checks that prove each protectionBuilding SecureLite
The free WordPress security plugin we built: 529 bad reviews of other plugins read, six of our own bugs fixed, and a scanner rebuilt after a real hack.
Read the case studyStraight answers
What website security
services can't promise.
For agencies
White-label WordPress
security for client sites.
Agencies get the same security standard on every client site, under their own brand: hardening, scanning, emergency response and a monthly report with your name on it, plus a written non-solicit so your clients stay yours.
Naveen Kumar
Founder & lead engineer · WordPress security expert behind SecureLite · Working 9am–6pm US Eastern
I clean hacked WordPress sites, I look after them afterwards, and I build SecureLite. The person who secures your site is the person who answers when something goes wrong, not a ticket queue. More about how I work →
Questions, answered
WordPress security services:
common questions.
What do WordPress security services include?
Ongoing WordPress security services cover hardening the site, protecting logins, scanning for malware, applying updates and security patches (tested on a staging copy first), daily off-site backups, uptime and SSL monitoring, and a fast response if something goes wrong. Ours are part of the Care + Secure, Store Care and Agency maintenance plans, which also include one hack cleanup a year.
How much do WordPress security services cost?
Security is included in our Care + Secure and Store Care plans, which have published monthly rates on the pricing page, and in the Agency plan for agencies. If your site is already hacked and you're not on a plan, the cleanup is quoted as a fixed fee before any work starts, so you know the price first.
Do I need a security service if I already have a security plugin?
A plugin is a tool; a security service is someone using the tools and acting on what they find. A plugin can flag a problem, but it can't update a site safely, restore a clean backup, close the way an attacker got in or ask Google to remove a warning. If nobody reads the alerts, the plugin is mostly decoration.
What's the difference between WordPress security and malware removal?
Security services are ongoing and preventive: hardening, monitoring, updates and backups, so a hack is less likely and caught early. Malware removal is the response once a site is already infected: cleaning it, closing the way in and getting any Google warnings lifted. We offer both, and the plans include one cleanup a year.
What is a WordPress security audit?
A review of how exposed a site is: software versions, exposed files, login protection, user accounts, backups and signs of an existing compromise. Our free assessment starts from the outside, the way an attacker sees the site, with written findings in one business day. Anything that needs a closer look inside the site is quoted as a fixed fee first.
Can you guarantee my site will never be hacked?
No, and you should be wary of anyone who does. What good security does is make an attack much harder, notice quickly when something changes, and recover cleanly. That's why our plans include monitoring, daily backups that are stored off the server, an emergency response target and one hack cleanup a year.
How fast do you respond if my site is hacked?
On Care + Secure, Store Care and Agency, a hacked site is an emergency with a response target of 2 hours in business hours (9am to 6pm US Eastern, Monday to Friday) and 4 hours outside them. Without a plan, send the site address and we reply within one business day with a fixed-fee quote.
Do you provide website security services for sites that aren't WordPress?
Yes. WordPress and WooCommerce are most of what we secure, but Webflow, static HTML and custom-coded PHP sites are covered too. We don't work on Shopify, Wix, Squarespace, Magento, Drupal or Joomla, and we don't resell hosting: your site stays on your own hosting account.
Do you offer white-label security for agencies?
Yes. White-label maintenance runs every client site to the Care + Secure standard, including security hardening, malware scanning and emergency response, with reports under your agency's brand and a written non-solicit.
What is SecureLite?
SecureLite Security is the free WordPress security plugin we built and published on WordPress.org. It includes an attack simulation that tests whether each protection actually blocks an attack. Anyone can install it; our security service is the hands-on work of an engineer looking after your site.