The Security Plugin Problem

What they actually do

Genuinely useful things, worth naming precisely so the gap is visible.

• Limiting login attempts, which stops automated password guessing.
• Scanning files for changes against known-good versions, which detects some compromises.
• Blocking requests matching known attack patterns, where they include a firewall component.
• Applying hardening settings, such as disabling file editing in the admin area.
• Alerting on events, such as a new administrator account being created.
• Two-factor authentication, where the platform does not provide it.

That is a real list, and the login limiting and change detection are the two with the clearest value for a small site.

What they do not do

The gap between the list above and what the dashboard implies.

They do not update your software. An outdated plugin with a known vulnerability remains vulnerable, and that is the most common route into a small site.

They do not fix a weak or reused password. An attacker with valid credentials is not attacking anything, they are logging in.

They do not protect the hosting account. A compromised control panel or FTP login bypasses everything running inside the site.

They do not protect what they cannot see. A plugin running inside the site is already downstream of the request, which limits what it can prevent.

They cannot secure an abandoned installation in a subfolder that nobody remembers.

The false confidence problem

The reason this matters rather than being merely a limitation.

A dashboard showing everything green produces a reasonable conclusion that security is handled. That conclusion reduces the urgency of the things that actually matter: updating, using unique passwords, and enabling two-factor authentication.

A business with a security plugin and an unmaintained site is in a worse position than one with no plugin and a well-maintained site, and it feels safer.

The honest framing is that a security plugin is a supplement to maintenance rather than a substitute for it, and that is not how they are marketed.

The performance cost

Real and worth weighing, since these are among the heavier plugins available.

A plugin inspecting every request, logging events, and running scheduled scans is doing work on your server continuously. Scans in particular can consume enough resource to slow the site noticeably while running.

On shared hosting this occasionally causes more visible harm than the threats it addresses, particularly where a scan runs during your busiest period.

Where you use one, scheduling scans for a quiet hour and reducing logging retention removes most of that cost.

The duplication question

Worth checking before installing anything, because a good deal of this may already exist.

Many hosts provide server-level firewalling, malware scanning, and brute-force protection as part of the plan. Running a plugin that duplicates it adds load without adding protection, and the two occasionally conflict.

Two security plugins is a specific problem worth naming. They interfere with each other, produce contradictory alerts, and can lock legitimate users out.

Asking your host what they already provide is a five-minute conversation that frequently makes the plugin unnecessary.

The alerts problem

These plugins are noisy by default, and the noise defeats them.

A daily email listing hundreds of blocked login attempts is background traffic every site receives. After two weeks it is filtered, and the one alert that matters is filtered with it.

Configuring alerts down to the few that genuinely warrant attention, such as a new administrator account or a core file changing, is what makes them useful. Everything else belongs in a log to be read when investigating something.

The ordering that actually matters

1. Keep everything updated, which addresses the most common route in.
2. Unique strong passwords on every account.
3. Two-factor authentication on anything that supports it.
4. Remove what you do not use, including abandoned installations.
5. Backups you could actually restore from a point before a compromise.
6. Then a security plugin, if the host does not already provide the equivalent.

The first five cost nothing and address more than the sixth does. A business that has done them is genuinely well protected for its size; one that has only installed the plugin is not, and the plugin is the reason they think otherwise.

The weight question that applies to any addition applies here too, and these are heavier than most, which is covered in plugins, add-ons, and accumulated weight.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.