If you’ve started reading about WordPress security, you’ve probably already run into conflicting advice: one guide swears by hiding your login URL, another calls it pointless. One says WordPress is inherently risky, another says it’s perfectly safe. Before adding another checklist to the pile, it’s worth sorting out which of the common claims actually hold up, because the mental model matters more than any single setting.
Myth: WordPress itself is insecure
WordPress powers over 40% of all websites, which makes it the biggest single target on the internet, but that’s a statement about volume, not about the software being fundamentally flawed. The core WordPress project is actively maintained and patches vulnerabilities quickly. The real exposure is elsewhere: independent research consistently finds that plugins account for the overwhelming majority of WordPress security issues, not core itself. A site running current WordPress core, but a dozen outdated or abandoned plugins, is far more exposed than a lean site running fewer, well-maintained ones.
The practical takeaway: the software you add to WordPress is where most of your real risk actually lives, not WordPress itself.
Myth: Hiding your login URL or renaming things makes you invisible
This one’s genuinely contested, and worth being precise about rather than picking a side dogmatically. It’s true that a sophisticated, targeted attacker can usually still fingerprint that a site runs WordPress and find its real login page regardless of what you’ve renamed, security through obscurity was never designed to stop a determined human. But the overwhelming majority of WordPress attacks aren’t a human sitting there probing your specific site, they’re automated bots blindly hitting /wp-login.php on millions of sites at once, with no idea or care which ones they’re hitting.
Changing the login URL doesn’t make you invulnerable. What it genuinely does is remove your site from that blind automated sweep, meaningfully cutting the volume of brute-force noise your login page ever sees, without doing anything to stop a real, targeted attack. Worth doing, worth understanding it’s a volume reducer and not a wall, and worth the specific warning that comes with it: it’s also the one setting most likely to lock you out if you misconfigure it, always verify the new URL works in a private browser window before you log out of your current session.
Myth: Install a security plugin and you’re now protected
This is the most comforting misconception, and the most common one. A security plugin is genuinely valuable, brute-force protection, malware scanning, 2FA, blocking common attack patterns, all things worth having. What it isn’t is a “set it and forget it” switch that makes the rest of this list irrelevant. If you install a plugin and then keep running outdated plugins elsewhere, skip backups entirely, and share one weak password across every admin account, the security plugin is doing real work, just not nearly enough to matter on its own.
A useful way to think about it: a security plugin is one layer, not the whole wall. It’s genuinely good at catching automated, high-volume attacks, brute-force attempts, known malicious file patterns, common exploit strings. It can’t retroactively patch a vulnerable plugin you haven’t updated, and it can’t restore your site from a backup that doesn’t exist.
Myth: My site is too small or unimportant to be a target
This is the one that gets the most beginners genuinely caught off guard. Attackers targeting a specific business, sure, size and profile matter there. But the vast majority of WordPress compromises have nothing to do with anyone caring about your specific site at all. Automated bots scan the entire internet indiscriminately, checking for known vulnerable plugin versions, weak passwords, and exposed endpoints, with zero regard for how much traffic you get or how “important” your site is. A five-page hobby blog and a busy e-commerce store running the same vulnerable plugin version are equally exposed to the exact same bot.
What actually matters, in one paragraph
Keep everything updated, delete what you don’t use, use unique strong passwords with 2FA on every admin account, back up somewhere off-site and actually test the restore, and treat a security plugin as one real layer among several, not a substitute for the rest. If you want the full step-by-step version of this, it’s covered in detail in how to secure a WordPress site.
Where a plugin genuinely helps, honestly
SecondGate covers the automated-attack layer that catches what bots throw at every WordPress site around the clock: brute-force protection and 2FA with passkey support are free forever. File integrity scanning with auto-restore and blocking common attack patterns sit in a Pro tier at £39.99/year, worth knowing upfront rather than assuming everything’s included. It doesn’t replace updating your plugins, and it doesn’t back up your site, those genuinely stay your job, and any plugin that implies otherwise is selling the “set and forget” myth from above.
