Services
WordPress Security
Last updated on
WordPress is not insecure – outdated installations are. We close known vulnerabilities promptly, secure the login, monitor the website continuously and restore it in an emergency.
Security status
Malware scan: no findings
214 login attempts blocked
No unknown admin accounts
All security updates applied
SSL certificate valid until 12/2026
Excerpt from a monthly maintenance report.
How attacks on WordPress work
Attacks are automated. Bots scan the web for websites running a plugin version with a publicly documented vulnerability – regardless of industry, size or visitor numbers. Once a vulnerability is published, it can be used by scans from that very moment. Update frequency therefore directly determines how long your website remains vulnerable.
Outdated plugins
The most common entry point. Even deactivated plugins remain vulnerable as long as the files are on the server.
Brute force at login
Automated login attempts on wp-login.php – effective against weak or reused passwords.
Expired licences
Premium plugins without a valid licence no longer receive updates – often unnoticed for months.
Spam & redirects
Compromised websites are misused to send spam or for hidden redirects. The domain then ends up on blocklists.
Our security measures
What works is a small number of consistently carried-out measures – not the longest possible list of installed security plugins.
Firewall
Filters known attack patterns before they reach WordPress and automatically blocks suspicious requests.
Login protection & 2FA
Limited login attempts, blocking of suspicious IP addresses and, on request, two-factor authentication for all editors.
Malware scans
Regular checks of files and database for malicious code, modified core files and unknown user accounts.
Prompt security updates
Checked and applied up to three times a week. Security-relevant updates are brought forward.
Country & IP blocking
In Business Enterprise: access from regions with no business relevance is blocked entirely.
CDN with DDoS protection
Bunny CDN absorbs traffic spikes and overload attacks while speeding up delivery at the same time.
Monitoring
Uptime, login and file-change monitoring reports anomalies automatically before visitors notice them.
Backups as a fallback
When something does happen
There is no such thing as complete security. What matters is how quickly an incident is detected and resolved. In all plans, restoration in an emergency is part of maintenance – with no hourly billing in a state of emergency.
01
Detect
Monitoring automatically reports an outage, file change or anomaly.
02
Contain
Secure the website, lock access, identify affected files.
03
Clean up
Remove malicious code or restore a clean state from the backup.
04
Close the gap
Fix the entry point, renew passwords, document the incident.
Questions about security
Suspect an incident or want your website's condition checked? Get in touch – we will look into it promptly.
Request a security checkA plugin can filter attacks, but it cannot update an outdated version. Without regular updates, the vulnerability stays open, no matter which firewall sits in front of it.
Yes. Scans look for software versions, not for companies. Small websites are in fact affected more often, because they are maintained less frequently.
Yes. We bill the clean-up of an existing incident by effort and then start ongoing maintenance.
Yes, in all plans. Starting with Business Basic, we restore a current backup in an emergency – at no additional cost and without hourly billing.
Security comes from regularity
Updates, monitoring and backups in one fixed monthly package – from €39 / month.
