Most hacked WordPress sites were never targeted. A bot found an out-of-date plugin, a reused password or a theme nobody had touched in years, and walked straight in. What stops it is mostly dull: keep everything updated, delete what you do not use, give every person their own strong login, and keep a backup you have actually tested.
I look after around 30 WordPress websites for businesses in Spain, the UK and Germany. This is not a security researcher’s view. It is what a working developer sees when sites break, and what I do regularly to stop them breaking. It is written for business owners, so you do not need to be technical to follow it.
So far, none of the websites I maintain has been hacked. But in the last two years I have been asked three times to help with a hacked WordPress site, and the story was the same every time. An outdated plugin had been used to inject JavaScript into the blog posts and landing pages, so anyone who opened the site was sent straight to a site of the hacker’s choosing.
Three cases is a small sample, and I would not call it a statistic. It does match what I see in my daily work: in my experience, an outdated plugin is the biggest security risk on a WordPress site.
The causes I see most often
Out-of-date plugins
Plugins are where most WordPress weaknesses turn up, because there are tens of thousands of them, written by different people to different standards. When a flaw is found, the developer publishes a fix and the flaw becomes public knowledge. From that day, automated scanners look for every site still running the old version. Nobody picked your site. It simply showed up in a list.
The scale is not small. Wordfence, which tracks WordPress vulnerabilities, added 2,073 new ones to its database in the second quarter of 2026, down from 2,738 in the first. That sounds like good news, but the number of high-threat vulnerabilities, the kind attackers are very likely to target and that can lead to a full site compromise, rose from 158 to 182. Wordfence also counted about 573,000 infected sites in Q2, 21% more than in Q1. As in earlier quarters, most of the vulnerabilities were in plugins. The figures come from Wordfence’s own Q1 2026 and Q2 2026 threat intelligence reports.
Abandoned plugins and unused themes
A plugin that its author stopped maintaining never gets a fix, so any flaw in it stays open for good. Unused themes are the same problem in quieter form. They sit in the folder doing nothing, still reachable by an attacker. Deactivating is not enough. If you are not using it, delete it.
Weak and shared logins
One login shared by the owner, the designer and the person who left two years ago. A password reused from another service that was breached. A username of “admin”. Bots try these combinations all day. Give each person their own account, remove people who have left, use a long unique password and switch on two-factor login for administrators.
Cheap or neglected hosting
Hosting matters more than people expect. On very cheap shared servers, one infected site can spread to its neighbours. Old PHP versions stop receiving security fixes. A host with no backups of its own leaves you with nothing to fall back on. You do not need an expensive plan, but you do need a host that keeps its software current.
On my own server, which runs cPanel, I added the CSF firewall, because it is not part of the standard setup. In the early days bot attacks were a constant problem, and CSF is what stopped them. I also run cPHulk, which watches for other attempts to break in.
Pirated themes and plugins
“Free” copies of premium themes and plugins are a classic way to get malware onto a site. The price of the real licence is small next to the cost of cleaning up afterwards. Buy it from the author or use the free version from the official WordPress directory.
What stops each one
| Cause | What stops it |
|---|---|
| Out-of-date plugins | Check for updates every day and apply them regularly, with a recent backup in place |
| Abandoned plugins and unused themes | Delete anything you do not use. Replace plugins that have not been updated in a long time |
| Weak and shared logins | One account per person, unique long passwords, two-factor login for administrators |
| Poor hosting | A host that keeps PHP and server software current and takes its own backups |
| Pirated themes and plugins | Only install from the author or the official directory |
What routine updates look like
It is less dramatic than people imagine. Updates are checked every day and applied on a regular basis. Sites on the Pro plan are backed up daily, so an ordinary plugin update does not get a separate backup. When WordPress itself or a plugin moves to a new major version, I take an extra backup first. Old themes and unused plugins get removed, and at the end of the month the client gets a written report of what was done.
Things do sometimes break. Most often the cause is a connection problem on a server I do not manage, where I only look after the website. In most cases a quick look at the log files shows which plugin is the problem, and reinstalling that plugin puts it right. If it is more serious than that, I roll the site back from a backup.
None of this is clever. It works because it happens regularly, whether or not anything seems wrong. A site that is checked daily rarely stays vulnerable for long.
What to do first if your site is hacked
- Do not delete anything yet. You want to find out how they got in, and deleting files removes the evidence.
- Change your passwords from a clean computer. That means WordPress administrators, hosting, FTP or SFTP, and the database. If you suspect malware on your own computer, scan it too.
- Tell your hosting provider. They can often see what happened on the server and may suspend the site to protect others.
- Check the user list. Look in WordPress under Users for administrators you do not recognise.
- Find your latest clean backup. This is where a good backup earns its keep. The more recent it is, the less you lose. See the lifeline of your business: regular backups and backup strategies for your website.
- Restore, then update everything before the site goes back online. Restoring an old copy and leaving the weak plugin in place just gets you hacked again.
- If personal data may have been exposed, check your legal duties. Under the GDPR you generally have to notify the data protection authority within 72 hours of becoming aware of a breach that puts people at risk. In Spain that is the AEPD. Take advice if customer data or orders are involved.
Frequently asked questions
Why would anyone hack a small business website?
Because the attack is automated, the size of your business does not matter. Hacked sites are used to send spam, host phishing pages, redirect visitors to scam sites or serve as a stepping stone to other sites. A small site with old plugins is an easy target.
Is WordPress itself unsafe?
The core software is looked after by a large security team and is updated quickly when a problem is found. The weak points are usually the plugins, themes, logins and hosting around it. A well-kept WordPress site is a reasonable thing to run a business on.
How often should WordPress be updated?
Check for updates daily. Security fixes should go in as soon as you have a recent backup and can confirm nothing breaks. Leaving updates for months is exactly the gap the automated scanners look for.
Do I need a security plugin?
A security plugin can add a firewall and login protection, and it helps. It does not replace updates, clean-up of unused code and good passwords. On an out-of-date site it is a new lock on a door with a broken window next to it.
Is a backup enough?
No. A backup lets you recover, but it does not stop the next attack. You need both: updates and good logins to keep people out, and a backup you have tested to get you back if they get in.
Want someone to do this for you?
Our WordPress maintenance plans cover daily update checks, backups, removal of old themes, a monthly security report and up to five hours of IT support a month, from 120€ a year per site, plus IVA.