This article mainly studies the problem of the robust security iterative learning control for nonlinear cyber‐physical systems, which suffer from external disturbances and denial‐of‐service (DoS) attacks. First, the nonlinear system can be transformed into an iterative linear data model, which is only used for the controller parameter design and the stability analysis without the physical meaning. Then, an extended state observer is introduced to estimate external disturbances along the iteration axis. At the same time, considering the influence of DoS attacks, an attack compensation mechanism is designed for DoS attacks along the iteration axis. In addition, an iterative‐varying penalty is designed to accelerate the convergence of the tracking error. Further, the mathematical induction is used to decouple the control input from the tracking error and the compression mapping principle is utilized to prove that the tracking error is ultimately bounded under the influence of disturbances and DoS attacks. Finally, the main results are verified by the motor simulation.