Russ
This is just sheer ignorance. If you think that security plugins are garbage and this is advice you give to other people, then you deserve to be hacked.
0 hacks to date proves nothing other than that you have been lucky.
This is no different than saying "locks on doors are garbage", I leave my doors unlocked all the times, zero burglaries to date.
Andreas
That is not ignorance, thats experience talking.
I have seen way too many sites get hacked WITH security plugins.
Almost all hacked happen because of exploits in software. Security plugins offer no protection against that.
You want to keep your site protected, keep your software updated.
Besides no using admin/pass._👍2
Raef » Russ
, I just recently cleaned an infected website that was repeatedly infected because the backdoor was outside the standard WordPress installation. So yes, security plugins only know what they know and nothing outside of that.
Russ » Raef
That may be true for SOME plugins, but not all. Wordfence also scans files outside your WordPress installation.
It's rather like a bad builder blaming the tools when the house falls down…
Andreas
Wordfence scanner is okay but not the best. It's also a pile of bloatware.
Security plugins offer very little protection. Hackers and scans don't waste time on those. They focus on the exploits. Why, because that's the fastest way to hack a site, t.
So if your software is not updated, it's not if, but when you get hacked.
Security plugins, (unless offer an update feature), are useless against those attacks.
I see this everyday. I host thousands and thousands of websites. I'm fixing numerous per week.
All the ones that are hacked, are the ones that are outdated. And guess what, most will have a security plugin, and people think they are safe. They are not. All they get is a false sense of security.
I heard it all. I have this plugin, I have CloudFlare I have a private server yada yada yada. They all have the same thing in common… Outdated software.
You are free to believe what you want. I have done and seen this too many times._👍1
Jordan
Dealing in absolutes will always bit you in the ass. Even with updated plugins, you can still be hacked. Time to report and resolution is sometimes weeks for a plugin affected by a vulnerability. You're better to look at using modsec rules.

Phebey ^✍️ » Russ
thanks. There is a couple of abandoned plugins. I will delete all of them.
Russ » Phebey
That will likely be the cause of your problem.
I would suggest installing Wordfence, which does more than just scan for malware.
It will scan your system for vulnerabilities, and check for abandoned plugins as well as plugins which have been removed from wordpress.org, it is also a web application firewall and will detect and from intrusions, injections, brute force logins etc and will block IP's which attempts anything dodgy.
It also has the option to scan files outside of WordPress.
Additionally you should make sure that the hosting providers malware scan is enabled in your hosting control panel so pickup any other malware that might be at play. Any decent host should have this option.
If you want a (non free) solution that automatically removes malware, try Malcare: https://malcare.com?src=0A82E8.