WordPress site got hacked, plugins were outdated — do i always have to update?

Quick summary for newcomers: The real issue isn't the number, but what it's based on.

If permission and scope aren't in writing, don't start that test.

the most overlooked point about wordpress security is this: Everyone rushing into wordpress security gets stukc at the same point.

if you have questions, write them; Ill answer as best I can.

Great work.

I think differently. Any unwritten clause becomes a point of disagreement later, as both sides remember it differently.

There are three things to check when doing this. The real issue isnt the number, but what its based on.

Don't hesitate to ask; those who don't ask always pay more. I mean correct me if I'm wrong.

I'm a small business, let me explain from my side. Your time to detect an issue directly determines its cost.

Hope this helps.

Noted, thanks. If you get three different answers on a topic, the question was asked wrong.

Start with a small trial; don't commit to everything at once. This is my opinion, I'm not claiming it's absolute truth.

The answer above hits the nail on the head. Mistakes made on the wordpress security side are usually reversible but expensive.

If you have questions, write them; I'll answer as best I can.

The answer above hits the nail on the head. Taking notes for two weeks yields better results than a six-month estimate.

Let me summarize the topic, since several different answers were given. Everything goes well for the first three months; problems arise in the fourth.

If you post the result here, it will help others too.

Let me speak from the other side; I'm on the supplier side. People defend habits, not processes. Resistance comes from there.

Hope this helps.

Let me summarize the topic since several different answers were given. An untested backup is not a backup.

The most overlooked point about wordpress security is this: Just because everyone does it doesn't mean it's right.

If you don't write this down from the start, it leads to arguments later. If you have questions, write them; I'll answer as best I can.

Just a heads-up. If the notification path is long, notifications don't arrive; missing notifications mean delayed incident detection.

You're right. Processes without records never improve, because you don't know what to fix.

If you have questions, write them; I'll answer as best I can.

The opposite happened to me that's why I'm writing. Taking measures without an inventory leaves doors you haven't seen open.

This is my opinion, I'm not claiming it's absolute truth.

thanks a lot Ill try it today.

If I understood correctly, you're saying: The biggest time-waster for us was not knowing who had the final say.

Processes without records never improve, because you don't know what to fix.