Is a Virus detection plugin is necessary for WordPress nowadays?

EDIT: I mean to prevent attacks and violations... for example i'm using this plugin: https://sucuri.net/wordpress-security/wordpress-security-monitoring and i recive daily emails about some "Login Failures" using "admin" as Username and some differents passwords from a lot of different IP address.

  • I've updated my answer, but please avoid editing question once answer is posted. Prefer to ask another question!! – F. Hauri Nov 2 '15 at 13:27
  • Why do you worry about login failures? Is your password not strong enough? – Philipp Nov 2 '15 at 13:56

You say:

I recive daily emails about some "Login Failures" using "admin" as Username and some differents passwords from a lot of different IP address.

It's easy to detect that Wordpress is used, and then it's easy to find the login page. Then bots try to login. This is (sadly) normal. When you have a server with SSH running, you will get many attempts to login to that server. This is how the world works nowadays. Bots from all over the world try to login to anything they find.

Use a good password for all admin accounts, 30 characters at least, like with Lastpass. Do you get alerts when somebody logs in? If they are successful, you get a warning via mail. The plugin could block the IP after 5 or 10 failed attempts.



Hosting a Content Management System (like Wordpress, Joomla, Drupal, and moslty all other CMS) means permitting users* to upload arbitrary files.

(* As users I mean: your authorized - but not necessarily experienced - users. Thanks to Jan Doggen for this precision)

So even if

  • your server doesn't try to execute this files,

  • your server is up to date and doesn't hold any known vulnerabilities

Uploaded files could be downloaded by other users and website visitors, who could use vulnerable systems.

In order to prevent this, if you hold arbitrary shared files, you have to check new uploaded files... And recheck them everytime your virus database will be upgraded (thanks to Steffen Ullrich for warning me about this)

But no.

If you

  • are the only authorized user on the box (or you really trust each other users)
  • don't care about what's happen outside your box,
  • keep your box up to date finely

Wordpress work fine without anti-virus

  • 1
    Checking uploaded files only is bad. Since malware is evolving fast and antivirus is just catching up you should check the fail again before it gets downloaded, at least if you got new antivirus pattern in the meamtime. – Steffen Ullrich Nov 2 '15 at 11:09
  • i just edited my first post with more informations. – Antonioz Nov 2 '15 at 13:00

Wordpress is one of the most frequently exploited content management systems. Reasons for this are:

  • Lots of poorly curated plugins you can install which don't get audited for vulnerabilities as well as they should and are rarely updated.
  • Admins which do not bother to keep their wordpress installations up-tp-date and run old versions with many known but patched vulnerabilities. Updating it is just one click from the admin panel, still many wordpress admins do not bother.
  • Admins with weak passwords.

A third party security plugin for Wordpress is unnecessary when you make sure that your wordpress installation is always up to date, watch out which plugins you install and use a strong password.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.