Security
Why WordPress sites get hacked (it is almost never WordPress)
1 September 2026 · 6 min read
On this page
The most common reaction to a hacked site is "why me?" — and the honest answer is that nobody chose you. Almost every WordPress compromise is automated, indiscriminate, and exploiting something that was publicly fixed months earlier.
Understanding that is useful, because it tells you exactly what prevents it.
It is not WordPress core
WordPress core is among the more scrutinised codebases on the internet, with a dedicated security team and automatic security releases. Core vulnerabilities are rare, and when they happen they are patched fast and pushed automatically.
Almost nothing we clean got in through core.
It is plugins, overwhelmingly
Plugins are written by tens of thousands of different developers with wildly varying skill and diligence. The average WordPress site runs twenty of them, each one code executing on every page load.
The pattern is depressingly consistent:
- A researcher finds a flaw in a popular plugin
- It is responsibly disclosed and patched
- The patch is published, which tells everyone the flaw exists
- Bots begin scanning the entire internet for the unpatched version
- Sites that have not updated within days are compromised automatically
Step 3 is the part people miss. A security release is not only a fix — it is an announcement. The window between a patch shipping and mass exploitation is frequently measured in days.
The other four causes
Abandoned plugins. Anything not updated in over a year will never receive a fix. Several plugins were removed from the WordPress directory this year after being compromised, and sites running them stayed vulnerable indefinitely.
Nulled themes and plugins. Pirated premium software very often ships with a backdoor deliberately included. This is not a risk of piracy, it is the business model of it.
Weak or reused passwords. Credential stuffing — trying passwords leaked from other breaches against your login — costs an attacker nothing and works often enough.
Compromised hosting. On cheap shared hosting, a neighbouring site can be the way in. This is a real cause, though less common than the others.
Why small sites are not safer
The most persistent myth in this area. "Why would anyone attack my little business site?"
Nobody did. A bot scanned a range of IP addresses, found a vulnerable plugin version, and exploited it without any human involvement. Your traffic, revenue and prominence are entirely irrelevant to that process.
In fact small sites are compromised more often, because they are less likely to be maintained. And they are valuable: your domain has reputation with Google, your server can send email, and both can be resold.
What actually prevents it
Five habits. Between them they stop almost everything above.
1. Update weekly, not eventually. The single highest-value action on this list, because it closes the window in step 4.
2. Delete what you do not use. Deactivated is not removed. An inactive plugin is still code on your server and still exploitable.
3. Watch for disclosed vulnerabilities. Knowing that something you run has a published flaw is worth more than any scanner, because it lets you act before exploitation starts.
4. Strong, unique admin passwords with two-factor. Kills credential stuffing outright.
5. Off-site backups, tested. Does not prevent anything, but turns a disaster into an inconvenience.
None of this is sophisticated, and that is rather the point. The attacks are automated and unsophisticated too. They succeed through neglect, not cleverness.
The honest problem with that list
It is boring, invisible, and only announces itself by failing. Nobody feels the benefit of a plugin updated on time. So it gets deferred, and deferred, and then the site is redirecting to a pharmacy.
That is what a care plan actually sells — not expertise you could not acquire, but the discipline of someone doing it every week whether or not it feels urgent. From $79 a month, with cleanup free if it ever happens anyway.
If you want to know where your site stands right now, our free plugin checks your installed plugins against the live vulnerability database and flags anything abandoned. No account, and it changes nothing.