Security is the part of WordPress maintenance that nobody notices until it fails, and we have cleaned enough hacked sites to have strong opinions. These are the plugins and services that actually reduce incidents across the fleets we manage.
How we chose
- Prevention over detection. Tools that block attacks before they execute ranked above tools that only alert.
- Performance cost. A security plugin that doubles page load is a problem of its own.
- Cleanup path. We credited tools with a clear route from “hacked” to “clean.”
- Vulnerability data quality, since most WordPress compromises come from known, unpatched plugin flaws.
- Fit for scale: does it make sense on one site, and does it still make sense on five hundred?
Verdict
For a single site, pair a free Cloudflare proxy with Wordfence and you cover the edge and the application. If you want guaranteed cleanup, Sucuri or MalCare are the ones to pay for. For agencies and hosts, Patchstack’s virtual patching is the highest-leverage spend per site because it closes the plugin-vulnerability window that causes most hacks.
At fleet scale, we think the right answer is to stop managing security plugin by plugin. WP Maintain includes a security agent that monitors, patches and reports across every site you manage, so hosts and agencies see vulnerabilities and incidents in one place. It is what we use to keep thousands of partner sites clean, and it works alongside the tools above rather than replacing your WAF.