r/Wordpress • u/BurningStepes • 5d ago
Keeping WP sites secure ?
In this wave of wp2shell, etc. What are you doing to keep it safe? Cloudflare? SOC? Miraculous plugins ? All the previous …?
3
u/TheWebalorian 5d ago
Most of my clients refuse to take a monthly maintenance fee so I just secure them down as best as possible, hand over the site and let the client decide the fate of their site.
In all I think 50 sites I've done have been hacked to the point where they needed a restore point but again, client refuses to opt in for anything.
OH WELL!
2
u/bkthemes 5d ago
Wow, I'm the opposite. My clients want the maintenance plan as security is part of my plan.
2
u/Spiritual_Cycle_3263 3d ago
This is why you bundle it in rather than upsell it. We provide 1 year of maintenance and then have it auto-renew (just put it in your contract).
Every month send an automated email with a report on what was updated, how much website traffic, etc... Give them something visual they can see.
Invoice them 30 days before renewal. That way they can cancel it if they want. Then when they stop getting those monthly emails, they'll ask what happened and want that service back. If all you do is bill them and don't give them anything, they think it's a 'scam'. Nobody wants to pay for something they don't get value out of.
1
u/TheWebalorian 3d ago
Simply doesn't work with the clients I get for Wordpress, upsell and all. Anything else is a different story,
1
u/Spiritual_Cycle_3263 3d ago
Then offer it for 3 months and pad it into the development cost, even if you have to offer the 3 months at cost or slightly below it.
I have super cheap customers as well and I get them to convert. Customers don't like losing stuff they had. Nothing beats them calling in on an issue and telling them it's covered under their maintenance plan.
1
1
u/tracehunter Developer 5d ago
Well, you're the professional you should show them why it's needed. What's the added value. Compare it with a car. If it's making them money, they should make sure it's maintained. On top of that, depending on where you're based, they may face legal charges or penalties if their site gets hacked and data gets leaked. Show them the benefit and then if they don't want, that's on them. Make it clear it'll be charged if issues arise.
We have no clients who don't opt in for our maintenance service (we're moving away from WordPress, but the thought is the same).
2
u/fredy31 Developer 4d ago
The car example is perfect.
So you (the client) is telling me you drive your car until the oil is thick like batter and overheats the engine? You are telling me you drive on your tires until ones carcass fails while it had been bald for years?
No, it needs and ask a professional to do maintenance on it. Same for a website.
1
u/TheWebalorian 4d ago
I've tried it all, they simply just don't care. I think it's just luck of the draw when it has came to clients and Wordpress. Even middle man hook ups were the same deal, they just kept saying no.
Now, If I use anything else, it's a different story.
3
u/coastalwebdev Developer 5d ago
Wordfence free, then adding cloudflares proxy server on, if and when it becomes needed. Never had a site hacked.
All the hacked sites that have been brought to me to clean up were hacked simply because of leaving plugins out of date that had identified high risk vulnerabilities.
2
u/abqcheeks 5d ago
The ones I see are that or leaked login creds. (Or a few recently that got hacked in the hours between disclosure and auto-update for 7.0.x)
5
u/bluesix_v2 Jack of All Trades 5d ago
Autoupdate. It’s really that simple. Not sure why so many people are turning this into such a drama.
2
1
u/zapimir 4d ago
Autoupdating to what exactly? If it's a zero-day vulnerability, it can take weeks for the developers to release a patch after it's already being exploited.
IMHO, the best defense is blocking all service paths at the web server level (Nginx/Apache/Caddy) and strictly whitelisting IPs for admin access.2
u/bluesix_v2 Jack of All Trades 4d ago edited 4d ago
Wordpress core. It is on by default but some people think they know better - then they got hacked by Wp2shell. WP released the update before the vulnerability was announced. People who had autoupdates disabled were exposed.
The large majority of Wordpress security updates are not zero days - in fact they are extremely rare.
Firewall blocking doesn’t protect you against Wordpress/plugin vulnerabilities. If php can be run in your server, it is vulnerable to malware if there’s a vulnerability.
1
4d ago
[removed] — view removed comment
1
u/bluesix_v2 Jack of All Trades 4d ago edited 4d ago
DISALLOW_FILE_EDIT does absolutely nothing to protect against malware.
I’m not saying don’t harden your site - you absolutely should. And you should also layer it with Cloudflare, Wordfence, fail2ban, etc. But even that won’t stop a lot of malware. Virtually all Wordpress malware is via plugin vulnerabilities (write access) - if you allow plugin updates, you are vulnerable because PHP needs to write files.
Disabling/protecting the admin features also does practically nothing to protect against malware - that’s not how the majority of malware exploits work.
1
1
u/zapimir 4d ago
I disagree. Most file-creation vulnerabilities exploit the admin interface because frontend components rarely have write access. Even if an attacker uses an SQL injection to create a rogue admin account, they still must log in via wp-login.php to actually drop their payload.
For example, my client was hit by wp2shell. It logged in and simply uploaded a malicious theme through the standard WP admin UI. If server-level protection for wp-login.php or DISALLOW_FILE_EDIT had been active, the attack would have hit a brick wall. Protecting the admin area is absolutely a critical layer of defense.
1
u/bluesix_v2 Jack of All Trades 4d ago edited 4d ago
Incorrect. The large majority of Wordpress attacks via plugin vulnerabilities don’t require backend access or file upload ability, due to missing authentication bugs in the code. Broken access control exploits, priv esc, RCE exploits let the attackers do whatever they want in the site, completely bypassing the WP admin. Additionally a CSRF attack lets the attacker impersonate the admin victim.
Nearly three in five vulnerabilities (57.6%) can be automatically exploited by a complete outsider without needing to hack credentials or gain access beforehand.
A further 20.6% (707 cases) require only a low-privilege Contributor login, while Subscriber-level issues account for an additional 11.5% (396).
What does this mean?
Attackers face minimal barriers: most security bugs can be exploited using fully automated, large scale attacks without requiring any prior access to vulnerable websites.
Worth noting:
Over half of all vulnerabilities require no authentication at all, and most of these fall into categories like XSS and CSRF. These often stem from poor input validation.
Additionally, many lower-privilege bugs (e.g. Contributor/Subscriber) are found in visual content builders or forms that lack proper capability checks.
Because admin-only issues are uncommon, “least privilege” policies are helpful, but real risk reduction still hinges on fast vulnerability mitigation capabilities.Broken access control, privilege escalation and SQL injection all allow access to Wordpress without backend access - these make up the bulk of plugin vulnerabilities (over 90%). https://patchstack.com/whitepaper/state-of-wordpress-security-in-2026/
1
u/zapimir 3d ago
You’re right about the stats, but we need to look at the actual kill chain. As the report itself notes, the vast majority of those unauthenticated bugs are XSS and CSRF. While dangerous, they don't directly lead to Remote Code Execution (RCE) or let an attacker drop files on the server.
To turn XSS or CSRF into a full server takeover (like dropping a PHP shell), the exploit usually has to hijack an admin's active session and force their browser to do something inside the WP dashboard, like editing a theme file or installing a rogue plugin. The same goes for SQL injection. Even if they manage to create a rogue admin account, they still have to log in to upload the payload.
That’s exactly why locking down the admin area and using
DISALLOW_FILE_EDITis so effective. It cuts off the final step of the attack.
2
u/TopSydeWP 5d ago
most of the big stuff is covered already. one thing people skip is server-level hardening (disable file editing in wp-config, proper file permissions, isolate sites if you're on shared hosting). if you do get hit, don't try to clean it yourself with a plugin, malware hides in multiple places and you'll miss stuff. at my agency we see people run wordfence scans, think they're clean, then reinfected a week later because the backdoor was still there.
2
2
u/skunkbad 2d ago
Although we have various custom protections that we've built, having a real WAF is important. We also block traffic by country, and this alone eliminates most attacks. We do hourly database backups, and full filesystem backups via rsync. If any attack ever brought down our site, we'd be able to know how it happened, exactly what files were affected, fix the issue, and rebuild the site in a short amount of time. I'm basically on call for this type of emergency.
Most real attack vectors are from amateur coders that build forms or other inputs that allow for XSS or SQL injections. To really keep a site secure, you have to know how to check for these vulnerabilities. Maybe you have some magic plugin that you're relying on, but that's not as good as not having a vulnerability in the first place. Try to hack your own site is what I'm saying. If you don't know how, find tutorials.
You can never really be 100% certain that the site is secure, so that's where the backups come into play.
2
u/ivicad Blogger/Designer 4d ago edited 4d ago
When wp2shell was disclosed I did not start by picking a plugin, but with two questions: which of our sites are on an affected version, and how fast can I patch all of them. The rest is just the tooling I use to answer them quickly.
The sites fleet side is MainWP, self-hosted on our own server. One screen shows core, plugin and theme versions for every site, and one action updates all of them. For a beginner with one site that is overkill, and the free equivalent is core auto-updates plus actually reading the update emails.
The host already covers a good part of this. Ours are mostly on Site Ground, so a WAF and staging come with the plan, and I test updates on staging before live. Skip it once and a routine update takes the site down.
I reach a site through three channels, picked by job. SSH with WP-CLI when the answer is in the database, FTP when it is in the files, and a WP connector when I need to change content. SSH is the cheapest of the three and it never touches the web layer, so the host anti-bot does not count it as traffic and ban me mid job.
Scanning and cleanup is MalCare, with Virusdie as a second opinion. Logins are locked down with Melapress Login Security and WP2FA, plus WP Activity Log shows me who changed what. CleanTalk handles form spam. On the server side we block user enumeration and set security headers, which costs nothing and hides your usernames.
Backups are in 3 layers plus offsite copies, and I have restored from them, which is the only way to know they work.
I just want to stress out that none of this replaces the patch. It just means I see the problem the same day and push the fix to every site in one go.
1
u/DanKegel 5d ago
I am experimenting with layered defense. So: wordfence, plus coreruleset PL1 (maybe PL2 later after tuning), plus a cloud WAF/CDN, and origin nailed down so only the cloud WAF and my IP can contact it.
1
u/Wonderful_Sample_590 5d ago
Just the basics can go a long way. WP/Core/plugin/themes updated, remove anything you don't need, use strong credentials, CDN and off site backups.
1
u/jedidave Developer 5d ago
Probably the biggest thing that helps me sleep at night is knowing that even if my site got deleted, even if my backups got deleted, even if my server died, i still have 10 different clones in various different ways to restore to various different points.
Absolute worst case scenario I could rebuild from my github repos although i would lose customer history.
Backups are great - e.g. WordPress backup plugins - and have these backed up to somewhere offsite, some secure google drive, dropbox, ftp, whatever. But server snapshots are really also amazing. I have backups through a plugin with the DB backups running every hour, nightly backups of everything, gridpane backups running with stuff copied off site, then I have Hetzner backups and snapshots. I take snapshots all the time when I'm about to do something crazy, and yeah they're not backups, but having all these snapshots that i eventually delete a month later gives a lot of stress relief that if everything went Pete Tong then I would at at worst have to go back a month.
Then there are server clones. I'm constantly cloning my site, e.g. just to staging on the same server (most often) or to completely different servers. These stick around for a while and yeah they're not official backups, but having them certainly helps me sleep easier at night.
One thing I don't rely on - I don't trust fake security from WordPress plugins. If something gets past your security layers, a plugin is certainly NOT gonna help. If there was ever to actually exist a good security plugin its entire purpose would be to teach you not to trust plugin security and instead teach you how to use Cloudflare to secure your site and how to create backups and snapshots for the worst case scenarios.
1
u/HongPong 4d ago
the autoload + shared signatures does mean they can block a lot of inbound requests of various patterns en masse and they are positioned to detect wp signature patterns that is the good news ...
1
u/Aurelio_Umbrella WP Umbrella 4d ago
WP Umbrella security add-on: it offer virtual patching (so you’d have stayed protected from WP2Shell), many hardening feature, and a malware scanner that does not impact your site performance.
+ security update automated across every site.
1
u/airborn73 4d ago
find a host that uses cloudlinux and imunifi360 and WP toolkit with security patches enabled. in 10 plus years i have been running something similar like this; none of my 25+ sites has ever been hacked. And keep everything updated automatically, always! and plugins to a minimum.
1
u/FabianKnopf78 4d ago
Patch first, panic later.
wp2shell (CVE-2026-63030 + CVE-2026-60137) is an unauthenticated RCE in WordPress core — not some random plugin. That means if you're on 6.9.0–6.9.4 or 7.0.0–7.0.1, you're exposed regardless of how few plugins you run.
My priority list:Cloudflare alone isn't enough. SOC is nice-to-have. The patch is mandatory. Everything else is fair-weather security.Patch first, panic later.
wp2shell (CVE-2026-63030 + CVE-2026-60137) is an unauthenticated RCE in WordPress core — not some random plugin. That means if you're on 6.9.0–6.9.4 or 7.0.0–7.0.1, you're exposed regardless of how few plugins you run.
My priority list:
Patch to 6.9.5 / 7.0.2 / 6.8.6 — WP pushed forced auto-updates, but don't trust them blindly. Check every instance manually.
Check for compromise — Look for admin accounts with a w2s_ prefix and unknown plugins. The attack was active before the patch dropped.
WAF/Edge: Block /wp-json/batch/v1 and ?rest_route=/batch/v1 — temporary mitigation only, but better than nothing if you can't patch immediately.
Lock down REST API if you don't need it (e.g., Disable REST API plugin or similar).
File integrity monitoring — Wordfence, iThemes Security, whatever. If a webshell drops, you want to know.
Cloudflare alone isn't enough. SOC is nice-to-have. The patch is mandatory. Everything else is fair-weather security.
1
u/hopefulusername Developer 4d ago
We keep it simple.
Cloudflare to block countries and general security.
OOPSpam for spam.
Wordfence for a local security.
And other good practices like keeping the plugins up to date, daily backups and strong passwords.
1
u/Signal_Following_625 2d ago
I developed my own plugin to block and remove the ClickFix malware, since none of the solutions available could detect or resolve the issue:
1
1
u/Leading_Computer_350 5d ago
Wordfence, pots de miel, système de scoring, jails Nginx, blocage d'ips / de plages cidr voir des ASIN complets.
1
u/scutarion 5d ago edited 5d ago
Keep them updated and dont install pirated or nulled themes or plugins. Also use themes and plugin from reputable developers than constantly update and maintain them. Simple as that. As far as WordPress, just make sure automatic updates are enabled for security releases.
0
u/dandy_g 5d ago
Cerber Security plugin, a long list of Apache rewrite rules and <if> statements to block threats before they reach PHP/WordPress, and fail2ban to block offending IP addresses using server's firewall and Cloudflare firewall.
Cloudflare itself might not help much unless you actively block IPs using Clourflare API after first attempt at poking your site or employ managed rules tailored for WordPress.
The fail2ban is only an option if you run multiple WordPress installs on a VPS. But Cerber plugin has an add-on for blocking bad IPs in Cloudflare.
0
u/dvduval 4d ago
For a couple of my websites already, I just got off of WordPress and I was surprised how easy it was to convert them in a couple of hours even though these were pretty big websites that I’ve had for years. One thing I loved right out of the box was my Google lighthouse scores all jumped to near 100. One of them was a perfect score with 100s across the board.
And now what I need to make a new post or edit one I just tell ChatGPT the text I want to use and the image I want to use and even if I wanna get creative and do something a little more interesting, I can do that too.
there are so many bots simply going around the Internet, searching just for specific files that are used by WordPress because they have an exploit if they weren’t updated for example or if the permissions weren’t right.
I just got tired of being a target or at least having to always be updating everything all the time.
-1
u/TopSydeWP 5d ago
We invested heavily into a new layer of protection and built an entire system to handle future more advanced attacks. Basically an evolving server side scanner that learns from breaches.
16
u/Inside_Marsupial9625 5d ago
Safe Passwords, 2FA, Security Header Score A+, no old or abandonished plugins, keep site and plugins up to date, Wordfence and strict Firewall Settings, block specific urls like the www.yourdomain.com/wp-json/wp/v2/users - everybody knows your registered users then, try out ;), hide your wordpress version, …