The problemThat plugin you have not updated in months is an open door.
In shortWordPress security services find and close the holes attackers use: outdated or abandoned plugins, leftover admin logins, exposed login pages and untested backups. They suit business sites and WooCommerce stores that have not been hacked yet. We deliver a written audit plus hardening from $399 in 2–5 days, with monitoring on care plans from $99 a month.
WordPress security services exist because most hacked sites were never targeted by a person. Bots scan the web constantly for a known hole in an outdated plugin, a weak admin password or an exposed login page, and they break into whatever does not resist. Patchstack counted 7,966 new WordPress vulnerabilities in 2024, and 96% of them were in plugins. Security is mostly about not being the easy one.
We audit your site for the weaknesses those bots look for, then close them: plugins, logins, user accounts, hosting credentials and backups. Hardening happens on a staging copy where we can, with a written recovery path so nobody gets locked out. You get every finding in writing. If the audit finds signs of an existing compromise, you hear about it immediately.
Maintained by Haider Ali, Founder & CEO · Updated
Most of these are housekeeping problems no plugin fixes for you. Each one is a door bots test every day.
A false sense of safety. A plugin inside WordPress cannot stop an attacker who comes in through the hosting panel, FTP, the database or a stolen password.
What we doLayered hardening a plugin cannot do alone: rotate hosting, FTP, database and WordPress credentials and salts, require 2FA, audit every admin, and put a firewall in front.
Each outdated or abandoned plugin with a known hole stays open. Skipping updates to avoid breakage keeps the risk in place.
What we doWe check every plugin and theme against vulnerability data, replace abandoned, removed and pirated ones, delete unused ones, and test updates on staging first.
Every leftover login is a password you no longer control. A plugin bug can also quietly add a new administrator you never notice.
What we doWe remove accounts nobody needs, put every user on the lowest role, and set up an alert whenever a new administrator appears.
Wasted server resources and constant worry. XML-RPC lets bots guess passwords without touching the renamed login page.
What we doTurn off XML-RPC if nothing uses it, rate-limit logins, require 2FA for every admin, and block bots at the firewall before they reach WordPress.
Hours lost on config workarounds, and an owner who is now afraid to touch any security setting at all.
What we doHardening done and tested on staging where possible, with a written recovery path so you never lose access to your own dashboard.
Money spent on a plan that only scanned for problems, or covered the wrong site, while the real holes stayed open.
What we doOne fixed price, $399 for a typical business site, for a written audit and hands-on hardening of your site. Everything we set up is handed to you. No lock-in.
We would rather tell you now than take the project and disappoint you.
| Starts from | $399 for a typical business site |
|---|---|
| Typical timeline | 2–5 days |
| Ongoing protection | Care plans from $99 a month |
| Best for | Business sites and WooCommerce stores that have not been hacked yet |
| Not for | Sites hacked right now: go to malware removal |
| What you get | A written audit, hardening, a firewall in front, off-site backups and monitoring |
| What it is not | A certified penetration test, SOC 2 or PCI audit |
| How pricing works | One fixed price; unusual setups are quoted before work starts |
Worth knowing: Security plugins help, but they cannot fix what they do not control: an abandoned plugin with a known vulnerability, an admin account belonging to a former contractor, or a backup stored on the same server it is meant to protect. Most of the work is housekeeping that no plugin does for you.
Core, themes and plugins checked against known vulnerabilities, abandoned and pirated plugins flagged, and core files verified.
Two-factor authentication for admins, strong passwords enforced, login rate limits, and old accounts removed.
Hosting, FTP and database passwords and the WordPress salts rotated, since attackers often come in that way.
Every user on the lowest role they need, and file editing from the dashboard switched off.
A web application firewall in front of the site, such as Cloudflare or your host's firewall, blocking known attacks and bad bots.
Daily off-site backups kept separately from the server, with a restore tested so you know it works.
Uptime, file changes, new admin accounts and blacklist checks. Who gets the alerts, and in what hours, is agreed up front. It is not 24/7 human monitoring.
A 22-second look at the work: a security audit, login and user hardening, a firewall with bot rules, and tested backups. From $399, 2–5 days.
That plugin you haven’t updated is an open door. A security plugin is not enough. Old contractor logins still work. Bots hit your login daily. There’s a better way. WordPress security that closes holes before bots find them. Login and user hardening. Firewall and bot protection. Backups you have tested. From $399 · 2–5 days · fixed quote. Get a fixed quote. pixelandoak.com/services/wordpress-security
All three have a place, and many sites end up with more than one. The question is what each one can actually stop.
| Security plugin | Host security add-on | Hardening service (us) | |
|---|---|---|---|
| What it does | Login limits, scans and a firewall inside WordPress | Malware scans and sometimes a firewall, run by your host | A written audit, then the fixes made by hand on your site |
| What it misses | Attacks through hosting, FTP or the database, and plugins it does not update | Often scans for problems rather than closing the cause | Ongoing monitoring unless you add a care plan |
| Who does the work | You | Mostly automated | We do, and hand everything over to you |
| Cost | Free, or a yearly subscription | A yearly add-on to your hosting bill | $399 one time for a typical business site |
| Best for | A baseline on every site | Basic scanning if you have nothing else | Sites that take money or leads and cannot go down |
Protection in front of WordPress as well as inside it.
Cloudflare WAF and bot rules, or your host's firewall
Two-factor authentication, login limits, file integrity checks
Daily off-site, encrypted, with tested restores
Uptime, file changes, blacklist and vulnerability alerts
Not sure whether a security check is what you actually need? Send over what you are trying to fix and we will tell you straight — including if a smaller job would do it.
Ask us first →A full security review of the site, server settings and users, with the findings in writing.
One price for hardening. Most sites fit the standard package; unusual setups are quoted before work starts.
Fixes applied on a staging copy where possible, then to the live site at a quiet time, with a written recovery path.
Monitoring and backups handed to you, or kept running on a care plan.
AI agents from our Engineering and Quality & Security divisions do the work, in parallel. Haider Ali, founder and CEO, agrees the plan with you and signs off everything before it reaches you.
A security audit and hardening starts at $399 for a typical business site. Ongoing protection with updates, monitoring and backups is part of our care plans from $99 a month. Cleaning up a site that is already hacked is quoted on the malware removal page.
WordPress core is well maintained and patched quickly. The risk sits around it: Patchstack found 96% of new WordPress vulnerabilities in 2024 were in plugins, and weak or reused passwords and poor hosting add the rest. All of that is fixable, which is what hardening is for.
A good security plugin is a sensible baseline, so keep it. It cannot rotate your hosting and database passwords, remove a former contractor's admin account, replace an abandoned plugin, or test that your backup restores. A security service does that housekeeping by hand and tunes the plugin so its alerts mean something.
No, and you should be wary of anyone who says so. New vulnerabilities appear every week. What hardening does is make your site a much harder target than the sites around it, and make sure a problem is caught early and can be undone from a clean backup.
A cloud firewall stops bad traffic before it reaches your server, so it also saves server resources and still works if WordPress itself is struggling. A plugin firewall runs inside WordPress and sees more about logged-in users. For most business sites, a firewall in front plus a well-configured plugin is the best mix.
Not if it is done carefully. We apply changes on a staging copy where possible, test logins, forms and checkout afterwards, and give you a written recovery path for every setting that could block access. DIY lockouts usually come from turning on several plugin features at once on the live site.
Require two-factor authentication for every admin, use unique strong passwords, limit login attempts, and turn off XML-RPC if nothing uses it. Then block bots at a firewall so most guessing never reaches WordPress. Moving the login URL helps a little, but it does not stop attacks through XML-RPC.
Common signs are unexpected redirects, spam pages showing up in Google for your domain, admin users you did not create, and warnings from Google or your host. Our audit checks for all of them. If you are seeing them now, go to malware removal instead.
Yes, with extra attention to checkout, payment plugins, customer accounts, order data and card-testing protection, since stores are a more valuable target. We also check that no unknown scripts load on checkout pages. This is hardening work, not a certified penetration test, SOC 2 or PCI audit.
Tell us about your business and we'll design a custom homepage concept within 48 hours — free, no strings attached.