WordPress security services, from hacked to hardened
When a WordPress site gets hacked, the clean-up is the easy part. The real cost is spam pages under your name in Google, a checkout or form that quietly stops, a customer data question you have to answer, and a lost week for your team.
Why work with Nirmal Gyanwali on WordPress security services?
The attacks are automated and constant, and being small is no protection: bots probe a five-page site the same way they probe a large one.
I’m Nirmal Gyanwali, founder of WP Creative. My team provides WordPress security services for Australian businesses: cleaning hacked sites, removing malware, closing the door the attacker came through, and watching your site with AI monitoring so a repeat is less likely and caught early if it comes. I set the direction and the standards.
What should WordPress security services include?
Everything that keeps attackers out and gets them out fast if they get in: tested updates, a firewall and malware scanning, tight access control, hardening, off-site backups, monitoring and a written incident response. A good provider also tells you how the attack happened. Without that, the same door stays open, and a cleaned site can be reinfected within weeks.
The six layers to ask about:
As of 26 October 2026, check the host’s PHP patch status too. PHP’s 21 October security advisory and 23 October follow-up require attention to the runtime and affected configuration, not only WordPress plugins. Ask the host to confirm the fix or applicable mitigation; do not assume a green WordPress dashboard proves it.
- Updates and patching, tested on staging
- Firewall and malware scanning
- Access: two-factor authentication, least privilege, no shared logins
- Hardening: debug off, file editing disabled, security headers
- Backups stored off-site, with a restore tested
- Monitoring and a written response time
How do WordPress sites actually get hacked?
Through the same three doors, again and again. An outdated or abandoned plugin with a known vulnerability. Weak or forgotten admin access, such as an old developer’s account with no two-factor authentication. And budget, crowded hosting where one compromised neighbour affects the rest. Close those three first, then check core, PHP and integrations too.
Every plugin is weight. You carry all of it, even if you use 5% of it. The pattern I see most often on sites my team inherits: features nobody uses any more, still installed. An old slider, a second form plugin, a comment system that draws spam and no real comments. Each one is code to patch and a door to watch. Before you add a security plugin, ask which features you can delete.
Plugin review deserves attention in the disclosure data: 91% of the new WordPress vulnerabilities reported in 2025 were in plugins, and only six were in WordPress core (Patchstack, State of WordPress Security in 2026).
01
Outdated or abandoned plugins
A known vulnerability in a plugin nobody updated, or one its developer abandoned. It’s the most common way in that my team sees.
02
Weak or forgotten admin access
Old accounts from past developers, shared passwords and no two-factor authentication. The fix is locking down who can log in.
03
Budget, crowded hosting
Shared servers where one compromised site can affect its neighbours, and nobody is watching. Good hosting makes your site a harder target.
Should I clean a hacked site myself?
Do the first three steps on the panel yourself, then get help unless you can find the way in. Deleting the visible malware is easy. Finding the backdoor, the rogue admin account and the plugin that let them in is the work. Skip it and the way in stays open: the attacker can be back within weeks, sometimes with spam pages showing under your name.
What a proper clean-up involves, whoever does it:
Ask for an incident handover: evidence preserved, likely entry point, persistence checks in files and database, affected credentials and integrations, clean recovery point, and remaining risks. If personal information may be affected, involve the privacy owner promptly; covered entities must assess suspected eligible breaches under the OAIC’s scheme, with notification depending on likely serious harm and applicable exceptions.
My team takes hacked sites on with ongoing care rather than as a one-off clean, because step 6 is what catches a repeat early. No one can promise an attacker never tries again, and no scanner catches everything. What monitoring does is reduce the risk and shorten the gap: detection depends on what the scanner covers and whether alerts are reviewed; no scanning interval proves every infection will be found within it. That’s why the hardening in step 5 matters as much as the scanning.
01
Contain
Lock down admin access, rotate credentials and take a full copy of the site for investigation.
02
Investigate
Review plugins, themes, user accounts, server logs and file changes to find the entry point.
03
Clean
Remove injected code, backdoors and rogue admin accounts across uploads, plugins, themes and core files.
04
Search clean-up
Find the attacker’s spam pages, remove them and ask Google to drop them, so they stop showing under your name.
05
Harden
Update everything, remove what is not needed, add two-factor authentication and a firewall, and tighten hosting settings.
06
Monitor
Daily malware scanning and alerts from then on, so a second attempt is caught early.
Should I rely on a security plugin?
Use one, but don’t rely on it. A security plugin is one layer. Depending on the product, it scans, blocks, alerts and sometimes updates. It won’t remove an old developer’s admin account, read the alert at 2am or own the fix. Security is a habit that people keep, with a plugin as one of their tools.
Common tool capabilities
Responsibilities to assign to a person
Scans files for known malware
Decide which plugins you should delete
Blocks common attack patterns
Review who has admin access
Sends alerts
Read them and act
Adds a firewall layer
Tell you how the attack happened
AI helps on the watching side. Monitoring now scores a site’s security setup, ranks what it finds by risk and flags it early, across SSL, security headers, email authentication, hardening and update status. AI ranks the findings. People fix them. My team uses AI this way across its whole WPO framework, to spot issues early and act on the data fast. And if your site was built with AI tools, whether that code is secure is its own question: see my AI website security page.
Real incidents my team has handled
A technology company with an active backdoor
A scan flagged more than a hundred files across uploads, plugins and WordPress core, injected through an abandoned plugin. Admin accounts from a previous provider were still there, automatic core updates were switched off, there were no backups in years and no two-factor authentication on any account. My team’s plan put stabilising first: replace WordPress core and the infected plugins with clean copies, reset every account, switch on two-factor authentication and backups, then keep it under ongoing care.
An IT services firm under bot attack
The site was slowing down under thousands of hits a day from likely bot traffic, while analytics showed no spike. My team switched on edge protection, set up daily performance monitoring and kept watching the site.
A B2B site with a hidden backlog of risk
A full backend security audit found a handful of critical and high priority issues, plus more lower-priority ones, including outdated PHP and risky plugins. The PHP upgrade and plugin updates were scheduled and worked through in priority order.
And the outcome to aim for every month: on one published client site, 99.89% reported uptime and no malware detected in 40 selected security scans in one reporting month, June to July 2026 (Clifton Lifestyle).
Who this is for
Good fit
- A hacked or infected WordPress site that needs cleaning and protecting
- Businesses handling customer data, payments or health information
- Teams whose IT department needs a security partner for the website
- Organisations facing vendor security assessments
Not a fit
- A one-off clean with no ongoing protection
- Sites where nobody will act on findings
- Non-WordPress platforms (ask, but WordPress is the core)
More questions about WordPress security
How do I stop my site getting hacked again?
Keep everything updated, testing on staging first. Remove plugins you do not need. Lock down who can log in, with two-factor authentication and no shared accounts. Keep off-site backups. And have someone actually watching. Security is not a one-time fix. It is a habit. My guide to WordPress backups covers the backup side.
Is WordPress secure?
Yes, when it is maintained. The attack surface includes plugins, themes, accounts, core, PHP and hosting. A disclosure census does not tell us what caused most successful breaches. A well-run WordPress site with tested updates, tight access and good hosting is a hard target. For practical steps you can take today, read my WordPress security tips.
What security credentials should I ask a web partner for?
Ask how they control access, whether code changes are reviewed and scanned before release, what their incident response time is in writing, and when they last restored a backup. Then ask about formal standards. WP Creative is working toward ISO 27001 certification; hosts such as WP Engine (ISO 27001:2022, SOC 2 Type II) and Kinsta (ISO 27001, SOC 2) hold their own. A host’s certificate covers the host’s platform, not the agency or the code on your site, so ask each party for its own. A supplier should also complete your security questionnaire in full.
What should WordPress security cost?
For how to judge it, read what a website should cost; security sits inside WordPress care plans, and WP Creative’s plans are at WP Creative.
Get your site checked or cleaned
If your site is hacked, call now. If you are worried it might be, book a free call. You’ll talk with me or my team, and we’ll look at it with you.
02 8278 7530 · Sydney support: WordPress support and maintenance
