Security
Why WordPress Sites Get Hacked (and How to Prevent It)
Most compromised WordPress sites are breached through known vulnerabilities that already have available patches. Here is how breaches occur and how to secure your site.
When business owners discover their site has been compromised—whether displaying spam redirects, flagged as unsafe by search engines, or injected with unauthorized code—their immediate question is usually: “How did they get in?”
The answer is rarely a targeted cyberattack. Instead, it is almost always the result of a known, public vulnerability left unpatched.
Public Vulnerabilities and Automated Scans
The core WordPress platform is actively maintained and generally secure. What gets sites compromised is the ecosystem around it: the roughly 60,000 plugins and the tens of thousands of themes, maintained by everyone from full-time companies to a hobbyist who lost interest in 2019.
When a security flaw is discovered in a plugin, the developer issues a patch, and the vulnerability is publicly disclosed so site owners know to update. Within hours of that disclosure, cybercriminals launch automated scripts across the web. These bots do not target specific organizations; they systematically scan millions of web addresses looking for any site running that specific, outdated plugin version.
The Patch Window: The window of vulnerability for your site
The question is not really “is my site secure.” It is “how long does it take, from a patch being published, before that patch is installed on my site?”
For a site where someone logs in weekly and clicks update, that window is a few days. There’s risk, but it is manageable. For a site where nobody has logged into the admin area since the launch party (or logs in but never runs updates), that window is far larger. During all of that time the site is publicly announcing the vulnerable version it is running.
It’s not uncommon for us to inherit sites with dozens of pending updates and multiple plugins with significant vulnerabilities. Most unpatched sites are not the result of deliberate neglect. Often, responsible staff members leave, notification emails go to unmonitored inboxes, or maintenance simply falls behind because the site appears to function normally on the surface.
The Danger of Unverified Backups
The second thing we find is ineffective or nonexistent backups. These can be caused by:
- No backup strategy ever being in place
- Backup tools that stopped running months before
- Backups are saved on the same server as the live website, rendering them inaccessible if the server fails or is infected during a server-level breach.
- Backups have never been restored, leaving site owners unsure if the files are functional.
An unmonitored, unverified backup is merely a hypothesis, not a recovery plan.
Four Steps to Secure Your Site
Securing a WordPress site does not require complex engineering — it just requires disciplined habits:
- Schedule Routine Updates: Apply core, theme, and plugin updates regularly. Take a site snapshot immediately beforehand so you can roll back instantly if an update causes a conflict.
- Monitor Disclosed Flaws: Use vulnerability monitoring services (such as Wordfence or Patchstack) to receive immediate alerts or virtual patches when a plugin on your site is flagged.
- Store Backups Off-Site: Save backup files to an isolated cloud environment entirely separate from your web hosting server.
- Test Restores Periodically: Restore a backup to a staging environment once or twice a year to verify that your data is complete and recoverable.
Why This Doesn’t Happen
Updates and backup monitoring isn’t fun and isn’t core to anyone’s business. It’s a chore that produces no visible improvement to the website, on a task that feels optional right up until the moment it very much is not.
That is why we built our WordPress Care Plans ($10/month). They include automated routine updates, vulnerability monitoring, and off-site backups. Whether you manage this maintenance in-house or partner with a provider, establishing a consistent update schedule is the single most effective way to keep your site secure. All web hosting plans also include WordPress Care as a bundled offering.
Is There a Better Way?
WordPress is an extremely powerful and flexible platform - there’s a reason that it powers close to 1/3 of sites on the internet. We recommend it for many projects. It avoids the vendor lock-in that comes with proprietary platforms like Wix and Squarespace, where you lose your site if you stop paying a monthly fee. WordPress can be picked up and moved to a host of your choosing at any point, and easily archived offline. A CMS (Content Management System - the technical name for platforms like WordPress) makes it easy to update your site at any point.
However, for sites that aren’t updated frequently, you may want to consider a static site. A static site doesn’t have an interactive editing interface behind it - it’s a collection of files that are generated once and served by a web server anytime someone accesses the site. Since there are no logins or admin interface, there is nothing to secure, and there are no plugins or themes to update. Static sites load extremely fast and score well on Google’s Pagespeed metrics, helping SEO. They are sometimes less expensive to build as well.
Whether WordPress makes sense really depends on the objectives you have for your site and your plans around updating it. If you’re interested in exploring the differences, check out our article, Static Site or CMS? Factors to Help You Decide.