Menu

October 2026

ServMe Security | Wordfence | Securing your WordPress | Website Security

, ,

Wordfence for NZ & AU Businesses: A Practical WordPress Security Guide

Your website is often the first thing a new customer sees, and for many small businesses it is also the most exposed part of their IT. If your site runs on WordPress, it is worth taking its security seriously. Wordfence is one of the most widely used WordPress security plugins, and we think it is a sensible starting point for NZ and AU businesses.

Why WordPress Sites Need Security Beyond Hosting

WordPress powers a huge share of the web, which makes it a popular target. Most compromises don’t come from clever attacks on your hosting provider. They come from outdated plugins, weak or reused passwords, and automated bots probing every site they can find.

Good hosting gives you a solid foundation, but it can’t see inside your WordPress install. A security plugin works at the application level, watching for the threats that server-level protection will miss.

What Wordfence Does

Wordfence bundles several protections into one plugin:

**Web application firewall (WAF):** filters malicious traffic before it reaches your site, and blocks known attack patterns.

**Malware scanner:** checks your core files, themes and plugins for known malware and unexpected changes.

**Login security:** helps stop brute-force attacks and supports two-factor authentication for your admin accounts.

**Alerts and monitoring:** emails you when something suspicious is detected, so problems don’t sit unnoticed.

There is a free version that covers the essentials, and paid options that add features such as faster firewall rule updates. Check the Wordfence website for current plans and pricing.

Check out Wordfence Premium

by clicking here
Wordfence Premium

Who Wordfence Is Right For

Wordfence is a good fit if you:

– Run a WordPress site for your business, such as a brochure site, a booking site or a WooCommerce store.

– Don’t have a dedicated IT person watching the site day to day.

– Want a recognised, well-documented tool rather than a patchwork of small plugins.

If your site isn’t built on WordPress, Wordfence won’t apply, and you’ll want to look at security options for whichever platform you use.

Getting Started With Wordfence

1. Back up your site before installing anything new.

2. Sign up through our link: [Get Wordfence](PARTNERSTACK-AFFILIATE-LINK).

3. Install the plugin from your WordPress dashboard and run your first scan.

4. Turn on two-factor authentication for every admin account.

5. Review the alerts it sends, and keep WordPress, themes and plugins up to date.

Security isn’t set-and-forget. A few minutes each month reviewing scan results and updates is what keeps a plugin like this effective.

Check Wordfence Pricing

by clicking here
Buy here

Pairing Wordfence With Good Hosting and Domain Habits

Wordfence is one layer. It works best alongside:

**Reliable hosting** with regular backups and SSL. Our ServMe Domains hosting runs on Australia/New Zealand-based infrastructure with ISPmanager.

**A domain you control.** Register and manage your .co.nz, .nz, .com.au, .au and .com domains through ServMe Domains,

**Strong passwords and a password manager** for every login to your site.

We were hacked | Wazuh Daily Reporting | AI System Monitoring

,

Our WordPress Website Was Hacked — Here’s How We Caught It Within 24 Hours

Why daily log monitoring matters more than any single security plugin.

Last week, our WordPress website was hacked — servmeit.co.nz was targeted by an automated attack that exploited a known vulnerability in UpdraftPlus, one of the most widely-used WordPress backup plugins in the world. It’s a good reminder of a hard truth in IT security: it’s not a question of if your website will be targeted, it’s a question of how quickly you find out when it happens.

In our case, the answer was: well within 24 hours. Here’s what happened, and why it matters for every business we work with.

What Happened

An automated attacker exploited a known security hole in an outdated version of UpdraftPlus — one of the most widely-used WordPress backup plugins, installed on millions of sites. Through that opening, they planted two hidden files on our site. They disguised them as innocent-looking plugins named “Wp Binder 079” and “Render Craft”. If you’ve found this page because you spotted either of those plugin names on your own site — stop reading, isolate that site right now, then get in touch. Neither is a real plugin.

Both files quietly created a hidden administrator account the attacker could log into later. This completely bypassed the normal login, and WordPress’s admin screens never showed it. One went further: it actively hid its own hidden account from the Users list, so a manual check wouldn’t have caught it either. It also registered a recurring background task to help it stick around and look like legitimate housekeeping.

This is a textbook “backdoor” attack. The goal usually isn’t immediate, obvious damage — attackers plant a foothold quietly, then come back later to do something worse: steal data, deface the site, attack other businesses, or hold it for ransom. We’re deliberately not detailing how either plugin triggered its hidden access. That’s the kind of detail that helps the next attacker, not the next reader.

The Plugin Was “Up To Date” — Almost

Here’s the detail that should make every website owner sit up: we had auto-update switched on for the vulnerable plugin. WordPress doesn’t apply third-party plugin updates the instant they’re released — it checks and applies them on its own schedule. In this case, the fix was already queued but hadn’t run yet when the attacker struck first.

This is the gap that catches people out. Auto-update feels like a solved problem, but a window always exists between a vulnerability becoming known and your site actually receiving the fix. Automated attackers specifically hunt for sites sitting in that window. This isn’t a reason to turn auto-update off — it’s a reason not to treat it as your only line of defence.

Contact us if you've been stung

and would like help cleaning and hardening your system
Email Support

How We Caught It

One of the two planted files contained a coding error. This caused WordPress to fire off its own built-in crash notification, which first caught our attention.

But that’s only half the story — and the less important half. We review security logs on every server we manage, every single day. We use Wazuh, a security monitoring platform, combined with AI-assisted analysis that flags what actually matters out of the thousands of log entries a busy website generates daily.

That daily discipline meant we were already digging into what had changed on the site within hours of the attack, not weeks or months later. We identified both hidden backdoor files and confirmed exactly when attackers planted them. We traced the attack back to the specific vulnerability that let it in. We checked the website’s database and every available log directly, and confirmed the attacker never actually got in — no hidden account ever existed, and no login attempt ever matched their access code. We quarantined the malicious files, patched the vulnerability, and hardened the site against similar attacks, all within the same day.

In short: the attacker got a foot in the door, but we closed it before they could walk through.

Why This Matters For Your Business

Most businesses only find out their WordPress website was hacked one of two ways: a customer tells them something looks wrong, or Google flags the site as unsafe. By then, the attacker has often had the run of the place for weeks.

The difference comes down to one thing: is anyone actually watching?

Keeping plugins updated is essential, and auto-update should be switched on everywhere it can be — but as this incident shows, even that isn’t a guarantee. Updates run on a schedule, vulnerabilities get exploited the moment they’re public, and there’s always a window between the two where a plugin can be technically “up to date” on paper and still vulnerable in practice. A security plugin on its own isn’t enough either — plugins get out of date, and vulnerabilities get discovered faster than any single tool can keep up with. What actually catches an attack in that window — the one neither patching nor a security plugin alone can close — is continuous monitoring and someone reviewing what the logs are telling you, every day, not just when something visibly breaks.

That’s exactly what’s included as standard for every website and server we manage at ServMe IT:

  • Daily log review across every managed server, using Wazuh security monitoring
  • AI-assisted analysis to surface genuine threats out of the noise, so nothing slips through because a human got busy
  • Rapid incident response — when something is found, we act the same day, not the same week
  • File integrity monitoring to catch unauthorized changes to your website’s code the moment they happen

If this had been a client site instead of our own, the process would have been identical — the same daily review, the same rapid response, the same result: caught and closed before any damage was done.

Check out our other Blogs

Show me more

Is Your Website Actually Being Watched?

  • Has your WordPress website been hacked, or are you worried it could be? If you’d like us to take a look at your current setup — no obligation — get in touch and we’ll let you know exactly where you stand.

  • If your current hosting or web support doesn’t involve someone actively reviewing security logs every day, the honest answer is: you probably won’t know about an attack like this one until it’s too late.

  • We provide weekly reports summarising what we have done for you during the week.

Talk to us

about securing your website
Email Support

Powered by CookieAdmin
×