Your WordPress Security Plugin Isn't Enough

Thanks Pressable for supporting the show! Get your special hosting deal at https://pressable.com/wpminute Become a WP Minute Supporter & Slack member at https://thewpminute.com/support This episode of The WP Minute takes a closer look at the state of WordPress security with Robert Abela, founder and CEO of Melapress, who joins Eric Karkovack to discuss the findings from Melapress’s annual WordPress security survey. The conversation starts with a surprising reality: security is a major concern for WordPress professionals, but many still don't have a plan for what happens when a site gets hacked. Robert explains why simply restoring a backup isn't enough, how attackers can leave backdoors behind, and why figuring out how a site was compromised needs to happen before recovery. Robert and Eric also dig into how WordPress professionals actually discover security incidents. Too often, it's a client, a search engine, or someone noticing strange behavior. By the time that happens, the damage may already be done. Logs, user monitoring, session management, and alerts can help catch problems much earlier. The episode also covers why smaller websites shouldn't assume they're safe, how AI is making targeted attacks easier, why security requires more than one tool, and the biggest security improvement agencies and freelancers can make right now: educating themselves and their teams. Takeaways Installing a security plugin isn't a complete security strategy. Restoring a backup won't fix the vulnerability that caused a hack. Logs can help uncover how a WordPress site was compromised. Early detection can dramatically reduce the damage from an attack. Small websites are still targets because most attacks aren't personal. AI is making targeted attacks easier to create. MFA and strong passwords don't protect against every attack. Security needs prevention, detection, and recovery working together. Many WordPress professionals still don't have a breach recovery plan. User education may be the most important security control of all. Important Links The full survey results discussed in the episode — Melapress WordPress Security Survey 2026 Real-world stories of WordPress security incidents and what it took to recover — Melapress Security Stories Robert's company and the WordPress security plugins discussed in the episode — Melapress Connect with Robert — Melapress Robert Abela on LinkedIn Robert's personal site — Robert Abela's website Subscribe to The WP Minute and join the community — The WP Minute Newsletter ★ Support this podcast ★