WordPress security
We protect your site with a firewall, 2FA, tested updates and monitoring.
client.noMonitoredGET /?s=' UNION SELECT user_pass185.220.•••.31StoppedSQL injectionPOST /xmlrpc.phpStoppedGET /blog/DeliveredPOST /contact/Stopped
- NetworkFilters flood attacks12,840
- Firewall (WAF)Stops known attack patterns847
- LoginTwo-factor and a cap on attempts1,912
- ContainerOwn IP address, no other sitesIsolated
- WordPressCore and 14 plugins up to date214
- Admin accounts with two-factor
- 4 of 4
- Plugins with known holes
- 0
- Last restore test
- 3 October
How WordPress sitesusually get hacked
WordPress accounts for most hacked content management systems (CMS), but the fault rarely lies with WordPress itself. The usual causes are plugins nobody has updated, passwords that have leaked from other services and a firewall that was never set up. WordPress security is mostly a maintenance problem.
client.noReading logs36 days unnoticed- Vulnerability in gallery plugin 3.2.1 publishedWPScan
- A bot finds version 3.2.1 on client.noAccess log
- Backdoor planted in uploads/2026/03/cache.phpFiles
- New admin account “wp_support” createdDatabase
- 340 casino spam pages addedDatabase
- Google marks the site as hacked in search resultsGoogle
A common pattern is that the site was handed over a few years ago without anyone being made responsible for updating it. Over time, security holes become known in several of the plugins, and the login page sits open to the internet without two-factor authentication.
A break-in is rarely noticed straight away. Often the first sign is a red warning from Google in the search results, and by then the attacker may have had access for weeks.
- Share of hacked content management systems running WordPress
- 90%
- Attacks our WAF stopped in the last 30 days
- 847
- Response time on critical issues, Enterprise
- <30min
- Monitoring around the clock
- 24/7
WordPress security at every layer
A security plugin runs inside WordPress, so it can only stop attacks that have already reached the site. We also put protection in the layers around WordPress, from the isolated environment the site runs in to the network where traffic arrives. Which layers are included depends on the level of your maintenance agreement. The WAF is included from Pro.
Website firewall (WAF)
The firewall sits in front of the server as a separate layer. Known attack attempts are stopped there before they reach WordPress.
Two-factor authentication
Everyone with admin access has to use 2FA, including the managing director. Bots try leaked passwords around the clock, so a password on its own isn't enough.
Isolated containers
Your site runs in its own isolated environment (a container) with its own IP address, not on a server shared with others. A break-in on another customer's site can't spread to yours.
Automatic security updates
WordPress and its plugins are updated automatically, so nobody has to remember to do it. Each update is tested first in a test environment, a copy of your site, before it goes to the live site.
If you have questions about the security of your WordPress site, call or write to us.
Tested WordPress updatesbefore they go live
An outdated plugin is still the most common reason WordPress sites get hacked. The other common problem is an update installed in good faith that breaks something else on the site, such as the checkout or a booking form.
So we update regularly, but test every update in the test environment first. There, automated tests check the contact forms and the payment flow, and another test compares before-and-after screenshots to catch layout errors. The update only goes to the live site once every test has passed.
client.noVulnerableFixed- Hole
- File upload without login
- Severity
- Critical · 9.8
- Installed
- 5.4.1
- Fixed in
- 5.4.2
- Updated to 5.4.2 on staging
- Contact form and checkout tested12 tests
- Screenshots compared0 changes
- Released on client.no
Attacks our WAF blocks every day
Our logs show the same types of attack day after day:
- Attempts to send database commands through search fields, comment forms and web addresses (SQL injection)
- Automated password guessing against the login page, often from thousands of hijacked machines
- Attempts to plant malicious code in form fields that don't check what's sent in (XSS)
- Attempts to make the site fetch and run malicious code from other servers
- Attempts to fetch files with passwords and settings that should never be public
- Floods of traffic meant to overload the site until it goes down (DDoS)
WordPress backupswith tested restores
Nearly every hosting agreement promises daily backups, but it's rare for anyone to have tried restoring one. Only a restore shows whether the backup is complete and the routine works.
Every night we take a full copy of the whole setup, including the server settings and files as well as the database. Everything is encrypted, and the copies are stored in several locations in the EU/EEA. We practise restores regularly, so we know the copies work and how long a restore takes.
Putting the site back to the previous copy takes less than ten minutes. Tested backups are included from the Pro tier of the maintenance agreement.
client.noRestoringPassed- 3 Oct 02:001.8 GBTesting
- 2 Oct 02:001.8 GB
- 1 Oct 02:001.7 GB
- 30 Sep 02:001.7 GB
- Copy fetched and decrypted
- Database loaded58 tables
- Files and server settings
- Site responds, login works
What we monitor around the clock
WordPress core
Every installation is checked against the latest official WordPress release. When a critical security patch comes out, we're alerted within hours.
Security holes in plugins
Your plugins are checked against the WPScan vulnerability database every day. Known security holes are marked and fixed as they come in.
Changes to files
The WordPress files are compared with the official originals continuously. If a file changes without us having published a change, we get an alert automatically.
SSL and security settings
We continuously check the SSL certificate and the security settings browsers rely on. A certificate that's about to expire is renewed before visitors notice.
User accounts
Accounts nobody uses are marked, and weak passwords are rejected. Every admin login is logged with IP address and time.
Scanning for malware
All files are checked for known malware. Files that match are set aside straight away, before the code can spread.
How we handlea hacked WordPress site
After a break-in, it's urgent. Google can mark a domain as dangerous within hours, and visitors then see a warning before they reach the site.
Our monitoring alerts us automatically to suspicious activity, and how quickly we start is set out in your SLA. For critical issues the response time is 4 hours within office hours on Basic and 30 minutes around the clock on Enterprise. First we shut the attacker out. Then we restore from the last clean backup and find the hole the attacker used, so it can be closed.
If you don't have an agreement like this, it's worth checking what your hosting agreement says about response times. Many say nothing at all.
client.noOngoingResolvedwp-includes/functions.php- Response time in the SLA
- 30 min
- Work started
- after 12 min
- Attacker locked outsessions, passwords and keys replaced
- Restored from a clean copythe 02:00 copy
- Hole foundoutdated image upload plugin
- Hole closedplugin updated, new firewall rule
- Written report sent
Security plugin or security around WordPress
| Free plugin | PXL securityRecommended for businesses | |
|---|---|---|
| Where the firewall sits | Inside WordPress | In front of the server (WAF) |
| Updates | Manual | Automatic, with testing |
| Active monitoring | Limited | Around the clock |
| Backups | Depends on a plugin | Copy of the whole setup |
| DDoS protection | No | At network level |
| Incident response time | No SLA | Agreed in the SLA |
| Site isolation | No (shared server) | Yes (dedicated) |
| Two-factor authentication | Optional | Required for admins |
GDPR and Norwegian security requirements
Data stored in the EU/EEA
All data is stored in the EU/EEA. None of it is transferred to a country outside the EU/EEA without a data processing agreement.
Logging and traceability
Every admin action is logged with user, IP address and time. You'll need that record if Datatilsynet, the Norwegian Data Protection Authority, gets in touch.
Encrypted traffic
All traffic is encrypted over HTTPS, with certificates that renew automatically.
Access control
Each user only gets the access their role needs. An editor can publish content but can't install plugins.
Signs your WordPress site is vulnerable
See how many of these apply to your site:
If three or more apply, have someone who knows security look at the site. Our maintenance agreement covers everything on the list from the Pro level.
- Nobody has updated the plugins for more than three months
- The admin accounts have never had two-factor authentication
- Nobody knows for sure who has access to the admin panel
- Your hosting agreement doesn't mention a WAF or DDoS protection
- Nobody has ever tried restoring the backup
- Google spotted your last security incident before you did
How to secure WordPress yourself
- Install security updates for WordPress, themes and plugins on the day they're released
- Turn on two-factor authentication for everyone with admin access
- Delete plugins and themes you don't use, because deactivated code can still be attacked
- Protect the login page (wp-login.php) against automated attempts, for example by limiting logins per minute
- Switch off XML-RPC, an older interface most sites don't use
- Put a website firewall (WAF) in front of the server instead of relying on a plugin alone
- Restore a backup at least once, so you know the routine works
- Monitor file integrity, so changes nobody asked for are picked up automatically
We can review the security of your WordPress site and tell you what to fix first.
Frequently asked questions
Is WordPress insecure?
No. WordPress has its own security team that fixes problems quickly. The problems arise around the platform: plugins that haven't been updated for a year, passwords that have leaked from other services and login pages left open to the internet. Set up properly and kept up to date, WordPress is as secure as other widely used platforms.
What does a WAF do that a security plugin doesn't?
The difference is where they sit. A WAF sits in front of the server and filters out attack traffic before it arrives, so dangerous requests are stopped before WordPress processes them. A security plugin runs inside WordPress, the very thing it's supposed to protect. If WordPress is compromised, the plugin is running on a compromised system, and you can no longer rely on it.
How often should WordPress be updated?
Updates that fix a security hole should be installed on the day they're released. Other updates can be tested in a test environment first, but should be live within a week. We handle both with a fixed, automated routine, so security updates go to the front of the queue and the rest don't get forgotten.
What happens if my website gets hacked?
Work starts within the response time in your SLA. Basic covers office hours, and Enterprise responds within 30 minutes around the clock. First we shut the attacker out and roll the site back to the last clean backup. Then we go through the logs until we know which vulnerability was used and how, and close the hole so the same route can't be used again. Afterwards you get a written summary of what happened.
Do I really need two-factor authentication?
Yes. Automated login attempts are among the most common attacks on WordPress, and the bots behind them work through leaked password lists around the clock. With two-factor authentication, whoever logs in also needs a one-time code, for example from an app on their phone. A leaked password is then not enough to get into your admin panel.
What does WordPress security cost at PXL?
Security isn't billed separately. It's part of our maintenance agreement, which starts at NOK 2,500 a month. Every level covers automatic updates, round-the-clock monitoring, backups and an agreed response time. The WAF is included from Pro, which starts at NOK 5,500 a month. You'll find each level and what it covers on our pricing page.
Can you secure a website that's already been hacked?
Yes, we do this regularly. We remove the malware and review everything the attacker changed, including backdoors left behind for a later visit. Then we tighten the security of the site and set up monitoring and a WAF, so the same attack won't work again. Our migration page describes the process step by step.
Do you support GDPR requirements for WordPress?
Yes. Data is stored in the EU/EEA and all traffic is encrypted. Admin actions are logged, so you can see who did what and when, and the whole setup is covered by a signed data processing agreement. Datatilsynet, the Norwegian Data Protection Authority, asks for this documentation in an inspection, and if it's ready, you can answer quickly.
A security review of your WordPress site
Send us the address and we'll go through the site and give you a concrete list of what needs fixing. What you do with it is up to you.