No security plugin, ours or anyone else’s, is a 100% guarantee. The honest safety net is a recent, tested backup stored somewhere other than your own server — and most sites don’t actually have one.
Most attacks on small WordPress sites aren’t a skilled attacker picking your site specifically. They’re a script trying common passwords against your login page thousands of times a day, fully automated, no human involved until it works.
WordPress itself has a pretty good track record It’s easy to assume “WordPress got hacked” means WordPress — the core software — had a flaw that let someone in. In practice, that’s…
WordPress runs roughly 4 in 10 websites on the internet — which is exactly why it’s the most targeted platform, and why “my site’s too small to matter” is the wrong way to think about risk.