WordPress security does not end with installing a security plugin. Most breaches stem from vulnerabilities in plugins and themes, plugin supply chain attacks, outdated software, and weak passwords. The WordPress core itself is well maintained, but third-party extensions remain the primary attack vector. Popular tools like Wordfence or Sucuri help, but used on their own, without proper server and hosting configuration, they create a false sense of security.
At WebOptimo we take a multi-layered approach to WordPress protection: from hardening the operating system and firewall, through the web server and PHP configuration, to application-level WordPress safeguards. We combine server administration expertise with deep WordPress experience, which lets us identify and eliminate threats at every level of the infrastructure. For more technical detail, see our WordPress Security knowledge base article.
A complete list of security features we configure in every WordPress site under our protection. Each item is a concrete technical measure, not a marketing promise.
A full backup of the database and all site files runs automatically every day. Backups are encrypted and stored in an off-site data centre, independent of the production server. We keep 30 days of retention, letting us restore the site to any point within that window. In the event of a breach or a human error, we restore the site within hours. More in our WordPress backups article.
Outdated plugins and themes are the most common cause of WordPress breaches. We update the WordPress core, theme, and every installed plugin every 14 days, testing each change on a staging environment first. Critical security patches are deployed within 24 hours of release. No uncontrolled automatic changes that could break the site.
Continuous uptime monitoring of the server and site around the clock. We check response times, HTTP status codes, SSL certificate validity, and the availability of key pages. Alerts reach us in real time, letting us react before visitors notice any downtime. We also track domain and SSL certificate expiration dates to prevent a site from going offline or triggering a browser warning without notice.
We configure an SSL/TLS certificate with HTTPS enforced site-wide, HTTP-to-HTTPS redirection, the HSTS header (Strict-Transport-Security), and a properly configured cipher suite. For sites that process personal or payment data (WooCommerce stores, contact forms), encrypted connections are not optional but a legal requirement under GDPR.
The WordPress admin panel is the primary target of brute-force attacks. We deploy login attempt limits with automatic IP blocking after the threshold is exceeded, two-factor authentication (2FA) for administrators and editors, a custom login path (replacing the default /wp-login.php), XML-RPC blocking, and IP-based wp-admin access restrictions where feasible.
We configure HTTP security headers that protect visitors against common attacks: Content-Security-Policy (XSS and code injection prevention), X-Frame-Options (clickjacking protection), X-Content-Type-Options (MIME sniffing prevention), Referrer-Policy (control over referrer information), and Permissions-Policy (browser API access control). Proper headers also improve scores in security audits and tools like Mozilla Observatory.
We secure the WordPress database on multiple levels: changing the default table prefix (wp_), restricting database user privileges to the minimum WordPress requires, regular database cleanup and optimization (removing revisions, transients, sessions, and debris left by deleted plugins), encrypting the connection between the application and the database server, and configuring MySQL/MariaDB according to the principle of least privilege.
A WooCommerce store processes personal and payment data, making it an especially attractive target. On top of standard WordPress hardening, we secure WooCommerce REST API endpoints, protect customer accounts against takeover (rate limiting, email verification), isolate order data, monitor payment gateways, and ensure compliance with GDPR requirements for storing and processing personal data.
Most WordPress agencies limit their security work to the application level: installing a security plugin, changing the login path, disabling XML-RPC. These steps matter, but they are not enough. At WebOptimo we combine server administration experience with WordPress expertise, which lets us protect every layer of the infrastructure.
We configure and maintain the servers that run our clients' sites. Linux administration (Debian, Ubuntu, Rocky Linux) and FreeBSD are part of our daily work. OS-level firewall configuration, SSH hardening, automated security updates, log and resource monitoring. When a problem lies on the server side, we do not have to wait for the hosting provider's support team to respond.
We configure Apache with restricted access to sensitive directories (wp-includes, wp-admin/includes), blocked access to configuration files and logs, hotlink protection, and request size limits. PHP-FPM runs with restrictive settings: disable_functions for dangerous functions (exec, system, passthru), open_basedir limiting filesystem access, and expose_php turned off.
We carry out comprehensive security audits covering the WordPress site, the hosting service, and the server configuration. We check OS configuration, open ports, software versions, file permissions, PHP settings, HTTP headers, the SSL certificate, plugin and theme vulnerabilities, password policies, and backup configuration. The audit concludes with a report containing specific recommendations, priorities, and estimated implementation time.
When a breach occurs, we do not stop at restoring a backup. We analyse server and application logs, identify the attack vector (an outdated plugin, stolen credentials, a server vulnerability), remove malicious code, deploy safeguards that address the root cause, and document the incident. We use WP-CLI for bulk file integrity checks and rapid patch deployment.
Most WordPress breaches could have been prevented by timely plugin updates, careful extension selection, and proper server configuration, not by installing yet another security plugin. Security is not a product you install but a process you implement and maintain. We approach it in layers: from the operating system, through the web server and PHP, to the WordPress application and daily monitoring. Security is an integral part of our WordPress care and every website we build. Plan details and pricing on the WordPress care pricing page.
No. Wordfence and similar tools (Sucuri, iThemes Security) protect at the WordPress application level but do not secure the server, PHP configuration, open ports, or the hosting service itself. They are an important layer of defence, but used on their own, without server-level hardening, they create a false sense of security. Effective protection requires safeguards at every level: the operating system, the web server, PHP, and only then the WordPress application.
The audit covers server and OS configuration, the hosting service, PHP version and settings, file and directory permissions, HTTP security headers, the SSL certificate and TLS configuration, plugin and theme vulnerabilities, password policies, backup configuration, and WordPress core file integrity. The results are delivered as a report with prioritized remediation recommendations.
Under our WordPress care plans, scanning runs daily. We monitor the integrity of WordPress core and plugin files, looking for backdoors, SEO spam, malicious redirects, hidden links, and unauthorized code changes. We track critical plugin vulnerabilities in real time using CVE databases and Wordfence Threat Intelligence reports.
We locate the breach source and attack vector, remove malicious code and backdoors, and restore a clean version of the site from a backup or manually clean infected files. We verify core file integrity, change all user passwords and security keys in wp-config.php, deploy additional safeguards to prevent re-infection, and submit the site for re-review in Google Search Console.
Most attacks on WordPress sites exploit plugin and theme vulnerabilities, plugin supply chain attacks, and weak passwords. A security plugin runs inside the WordPress application, so if an attacker gains server-level access (via SSH, FTP, or a hosting panel), the plugin is powerless. That is why defences must cover both the WordPress application and the foundation beneath it: the operating system and server configuration.
Yes. Both WordPress care plans (Standard and Professional) include WAF firewall configuration, daily malware scanning, 24/7 uptime monitoring, brute-force login protection, virus removal in case of infection, and regular updates for the WordPress core, plugins, and theme. Details and pricing on the WordPress care pricing page.
A WordPress and hosting security audit starts from PLN 379 net. The scope and final price depend on the complexity of the site, the number of plugins, and the server and hosting configuration. After the audit you receive a report with specific recommendations and implementation priorities.
One-time virus and malware removal from a WordPress site starts from PLN 499 net. The price depends on the scale of the infection, the number of infected files, and whether the site has been blacklisted by Google. For sites covered by a WordPress care plan, virus removal is included at no extra charge.
A WooCommerce store processes personal and payment data, which calls for additional safeguards. On top of standard WordPress hardening, we deploy SSL/TLS encryption across the entire site, secure WooCommerce REST API endpoints, protect customer accounts against takeover, isolate order data, monitor payment gateways, and ensure compliance with GDPR requirements for storing personal data.
Order a security audit or discuss protecting your site. We will prepare a proposal tailored to your infrastructure and needs. No obligations, no marketing jargon.
VAT ID: PL6391758393
