WordPress Security: How Sites Actually Get Hacked and What to Do About It
The most common misconception about security sounds like this: “who would bother with my small site”. It assumes attacks are targeted. In reality the overwhelming majority are automated: a script walks through millions of addresses checking for known vulnerabilities. It does not care whose site it is or how many visitors it has.
So the question is not whether you are interesting to anyone. The question is whether you have an unpatched hole from a well-known list.
How sites are actually compromised
| Vector | What it is | What closes it |
|---|---|---|
| Outdated plugins and themes | The most frequent cause. The vulnerability is published, the update exists, nobody installed it | Regular updates |
| Weak passwords | Automated guessing of common combinations | Long passwords, two-factor authentication |
| Abandoned components | A plugin was deactivated but not deleted. The code is still there | Removing what is unused |
| Shared hosting | A neighbouring site on the same account was compromised | Isolation, a separate account |
| Pirated themes | A backdoor built into a “free premium theme” | Official sources only |
| Forgotten access | An account belonging to a contractor who left a year ago | A user audit |
Note that nothing on this list is exotic. These are not sophisticated attacks, they are doors left open.
Plugins: the main source of risk
An average site runs fifteen to thirty plugins. Each one is somebody else’s code with full privileges inside your site.
Practical rules that remove most of the risk:
- Fewer means safer. A plugin installed two years ago “to have a look” is an open attack surface providing no benefit at all.
- Check the last update date. A plugin untouched for a year is most likely abandoned.
- Deactivating is not deleting. The files of a deactivated plugin stay on the server and in some cases remain reachable from outside.
- Updating is not a one-off event. Fifteen minutes once a week closes more than any paid protection.
The access nobody remembers
A typical picture at a company with a three-year-old site: eight administrator accounts, two belonging to former employees, one to the contractor who did the redesign, and one called “test”.
What is worth doing right now:
- Open the user list and delete everyone you cannot name.
- Downgrade roles: most people do not need administrator, editor is enough.
- Enable two-factor authentication at least for administrators.
- Change hosting and database passwords if they were ever sent over a messenger.
Why small sites get compromised at all
Understanding the motive helps you spot problems earlier. Usually the site is wanted not for itself but as a resource:
- Sending spam from your domain until it gets blacklisted.
- Hidden links to third-party sites, visible only to crawlers.
- Redirects sending mobile visitors to external pages.
- A phishing page on your domain, because your domain is trusted.
- Server compute resources.
All these scenarios share one thing: the compromise is meant to stay unnoticed. The site keeps working and the owner learns about it from the hosting provider or a search warning.
The mandatory minimum
| Measure | Time required | What it closes |
|---|---|---|
| Auto-updates for core and plugins | 10 minutes once | The bulk of automated attacks |
| Two-factor authentication | 15 minutes | Password guessing and theft |
| Login attempt limits | 10 minutes | Brute forcing |
| Off-server backups | 30 minutes | The consequences of any scenario |
| User audit | 20 minutes | Forgotten access |
| Deleting unused plugins | 30 minutes | Half the attack surface |
The most important line here is backups, and it is the one most often done for form only. A copy sitting on the same server does not help: in a compromise it disappears along with the site. Backups also need testing, because an unverified restore is not a backup, it is a hope.
Signs a site is already compromised
- Search results for your company name show pages you did not create.
- Your host reports exceeding the outbound email limit.
- The site opens normally for you, but acquaintances report being redirected.
- New administrator accounts appeared that you did not create.
- Files with random names sit in the root folder.
- Search Console sent a warning about harmful content.
What to do if it happens
- Do not delete anything immediately: take a copy of the current state first, you will need it for analysis.
- Change every password: administrators, hosting, database, FTP.
- Restore from a backup taken before the infection, not from yesterday’s.
- Update everything: core, themes, plugins.
- Delete unknown accounts.
- Check the site in Search Console and request a review.
WordPress security is not a product you buy. It is a handful of regular actions, each taking minutes. The difference between a site that held and a site that fell almost always comes down to whether somebody installed the updates and whether a working backup exists off the server.
