Most WordPress owners do care about security. The trouble is that a lot of the advice they pick up is half right, and half-right advice is expensive: it gives you the feeling of being protected while the real gaps stay open.
Below are the myths that come up most often when owners describe their setup. For each one: why it sounds believable, what is actually true, and what to spend your time on instead.
Myth 1: “My site is too small to be targeted”
Why people believe it. It feels logical. A hacker would surely go after a bank or a big shop, not a local clinic or a consultant’s five-page site.
What is true. Almost nobody chooses your site. Attacks on WordPress are overwhelmingly automated. Software scans huge numbers of sites looking for a known weak plugin, a guessable password or an outdated install, and breaks into whatever it finds. Small sites are often easier because nobody is watching them. A hacked small site is still useful to an attacker, for sending spam, hosting phishing pages, or adding hidden links for search spam.
Do instead. Assume you will be tested, because you will be. Keep things updated and logins strong, and the automated attacks pass you by.
Myth 2: “I have a security plugin, so I am safe”
Why people believe it. A plugin like Wordfence or Sucuri shows a dashboard full of green ticks and blocked attempts. It looks like a guard on duty.
What is true. A security plugin helps. It can scan files, limit logins and block some known attacks. But it cannot patch a vulnerable plugin you have not updated, it cannot fix a weak password on an old admin account, and it cannot restore your site if the server fails. It also runs inside WordPress, so if the site is badly compromised, the plugin can be switched off or fooled along with everything else. We go through the limits in do you need a WordPress security plugin.
Do instead. Install one good plugin, configure it properly, and read its alerts. Then treat it as one layer, not the whole plan.
Myth 3: “Hiding the login URL or renaming admin is enough”
Why people believe it. If attackers cannot find the login page, or do not know the username, surely they cannot get in.
What is true. Both changes reduce noise. Moving the login page cuts down on automated guessing, and getting rid of a username called “admin” takes you off the laziest lists. Neither stops an attacker who uses a flaw in a plugin, which skips the login page entirely. Usernames are also often discoverable from author pages and other places WordPress shows them. Our post on changing the WordPress login URL covers what it does and does not achieve.
Do instead. Put the effort into two-factor authentication for every administrator and a limit on failed logins. Those protect the door even when someone knows exactly where it is.
Myth 4: “WordPress itself is insecure”
Why people believe it. You hear about hacked WordPress sites all the time, so the software must be the problem.
What is true. WordPress is the most widely used website software, so it is also the most widely attacked, and the stories add up. WordPress core is maintained by a dedicated security team and fixes are pushed out through automatic updates. Most problems come from what gets added on top: outdated or poorly written plugins and themes, weak passwords, and hosting that nobody maintains.
Do instead. Keep the number of plugins down to the ones you actually use, choose plugins that are actively maintained, and delete the rest. Switching platforms will not help if the habits stay the same.
Myth 5: “The padlock means my site is secure”
Why people believe it. Browsers show a padlock, and for years people were told to look for it before trusting a site.
What is true. The padlock means the connection between the visitor and your server is encrypted, so nobody in between can read or alter what is sent. That matters, and every site should have it. But it says nothing about whether the site itself is clean. A hacked site can have a perfectly valid certificate, and so can a phishing site.
Do instead. Keep SSL in place and renewing automatically, and do not count it as a security measure beyond what it actually does.
Myth 6: “My host handles security”
Why people believe it. You pay for hosting, the plan page mentions security, and some hosts do include firewalls and malware scanning.
What is true. Hosts generally look after the server: the operating system, the network, and keeping one customer’s account apart from another’s. What runs inside your account, meaning WordPress, your plugins, your theme and your user passwords, is usually your responsibility under the hosting terms. Managed WordPress hosts do more, but even they rarely take responsibility for a vulnerable plugin you chose to install. We look at this in more detail in is your web host responsible for a hacked website.
Do instead. Read what your plan actually includes. Whatever is not listed, assume it is yours to handle or to hand to someone.
Myth 7: “Backups on the same server are fine”
Why people believe it. The hosting panel or a backup plugin says backups are running every day. That sounds covered.
What is true. A backup kept on the same server shares the same fate as the site. If the server fails, the account is suspended, or an attacker gains access to the files, the backups can go with it. Backups that keep only the latest copy can also overwrite your clean version with an infected one before anyone notices the hack.
Do instead. Keep at least one copy somewhere else, such as cloud storage you control, keep several dated versions, and test a restore now and then. A backup you have never restored is untested.
Myth 8: “A premium theme from a download site is fine if it looks fine”
Why people believe it. The theme installs, the demo looks right, and the site works. If something were wrong, surely you would see it.
What is true. “Nulled” copies of paid themes and plugins, the ones offered free on unofficial sites, are a common way malware gets onto WordPress sites. The malicious code is usually written to stay hidden: a backdoor, a hidden admin account, or spam links that only search engines see. They also never receive genuine updates. We explain how this works in nulled plugins and themes.
Do instead. Buy premium themes and plugins from the developer or an official marketplace, or use a well-maintained free one from WordPress.org. If you already have a nulled copy installed, replace it with a genuine one and have the site checked.
Myth 9: “Updates break sites, so it is safer to skip them”
Why people believe it. Many owners have had an update break a layout or a form once, and decided never to risk it again.
What is true. Updates can occasionally cause a conflict, and that is real. But many updates fix security flaws, and once a fix is published the flaw becomes public knowledge too. Skipping updates swaps a small chance of a visible problem for a growing chance of a hidden one.
Do instead. Update with a routine rather than avoiding it: take a backup first, update on a staging copy if the site matters to your income, update one thing at a time, and check key pages and forms afterwards.
What these myths have in common
Each one is a single action standing in for an ongoing habit. Real protection is mostly dull: updates, sensible logins, off-site backups and someone noticing when something changes. If you would rather not carry that yourself, our website security maintenance page explains what we check and how ongoing monitoring fits into a maintenance plan.
