For years, one of the biggest pieces of advice we’ve given clients has been simple: install as few WordPress plugins as possible.
Plugins are one of the things that make WordPress so powerful, but every plugin you add introduces more code to your website. More code means more updates to manage, more opportunities for conflicts, and potentially more security vulnerabilities.
That’s why we recommend:
- Only installing plugins that are genuinely needed.
- Choosing well-established, actively maintained plugins that have a reputable team behind them.
- Deleting plugins you’re no longer using, even if they’re inactive.
- Asking us for advice before installing something new, as the functionality may already exist in your website’s theme or current setup.
These have always been good practices. What’s changed recently is the threat landscape.
AI is changing website security
Until recently, finding vulnerabilities in WordPress plugins required significant technical expertise and a considerable amount of time.
Today, artificial intelligence is dramatically accelerating that process.
WordPress security specialists Wordfence uses AI to search for vulnerabilities and that’s dramatically increasing the time it takes them roll out protections to the users of their plugin.
That’s the good news.
The less encouraging news is that the same technology is available to threat actors. The techniques being used by legitimate security researchers to find weaknesses can also be used by cybercriminals looking for websites running vulnerable plugins, themes or outdated software.
In practical terms, vulnerabilities are being discovered faster than ever before, and attackers are becoming faster at exploiting them.
We install Wordfence on most WordPress websites
The free version of Wordfence provides an excellent baseline level of protection, including:
- Two-factor authentication (2FA)
- Brute force login protection
- Malware scanning
- Login security tools
- Security alerts and monitoring
For many organisations, this provides a strong first line of defence.
Why we’re increasingly recommending Wordfence Premium
The key difference between Wordfence Free and Wordfence Premium is the speed at which new protection is delivered.
WordPress security specialists Wordfence now use AI to help discover vulnerabilities, dramatically accelerating their ability to identify threats and roll out protections to Wordfence users.
Historically, that delay was often acceptable because newly discovered vulnerabilities could take some time before they were widely exploited.
However, as AI accelerates vulnerability discovery and exploitation, the gap between a vulnerability being discovered and attackers targeting it is shrinking. Wordfence itself argues that defenders must increasingly rely on AI-assisted security tools to keep pace with AI-enabled attackers.
Our recommendation
Good security still starts with the basics:
- Keep WordPress, themes and plugins updated. We take care of this for most of our clients.
- Install as few plugins as possible.
- Remove anything you don’t need.
- Use strong passwords and two-factor authentication.
But in today’s AI-driven threat landscape, real-time protection is becoming increasingly important.
For that reason, we’re continuing to install Wordfence Free as a minimum standard on all websites, while recommending Wordfence Premium for clients who want the highest level of protection available.
The reality is simple: AI is helping security researchers find vulnerabilities faster. Unfortunately, it’s helping attackers do the same. The best defence is making sure your website receives protection as quickly as possible when new threats emerge.
Get in touch if you’d like to chat and learn more.