When WordPress security fails, the plugin to blame is almost never the one you think about. It is the one you installed two years ago to add a contact form, stopped using, and never deleted. It still sits there. The developer stopped updating it eighteen months ago. And a bot found it before you remembered it existed.
This is the boring, unglamorous truth about WordPress security. It is rarely a hooded hacker targeting you. It is an automated script finding a known hole in old code, on your site and ten thousand others, all at once.
Plugins are where WordPress actually gets broken
WordPress core itself is pretty solid. When it comes to WordPress security, the team behind it patches fast, and the soft spots are the extras you bolt on.
The numbers are blunt. In 2025, around 92% of hacked WordPress sites were breached through plugins and themes, not the core software. And about 52% of plugin vulnerabilities traced back to outdated versions, ones where a patch existed but the site owner never applied it. The fix was sitting there. Nobody clicked update.
Abandoned plugins are worse, because there is no fix to apply. In December alone, over 150 plugins were pulled from the official WordPress directory for unpatched security holes or developer inactivity. Many carried plugin vulnerabilities that will never be patched, and plenty of those plugins are still running on live sites right now, quietly waiting.
Why small sites get hit hardest
A lot of small business owners assume they are too small to bother with. That is exactly backwards. Nobody is choosing you. The bots do not care what your site is worth. They scan by vulnerability, not by target.
The scale is hard to picture. Roughly 90,000 attacks per minute hit WordPress sites worldwide. When a new vulnerability is disclosed, the median time before it is first exploited in the wild is about five hours. Five. By the time a fix is even announced, bots are already sweeping the internet looking for sites that have not applied it, reading version numbers straight off your pages to find easy marks.
Small sites also tend to sit on budget hosting, which usually lacks the edge firewall that would block a lot of this junk before it ever reaches your site. Cheap hosting plus a forgotten plugin plus automated scanning is the exact recipe, and it plays out thousands of times a day.
What a hacked WordPress site actually looks like
Most people do not find out from a hacker's ransom note. They find out from a customer, or from Google, or from their own site behaving strangely. These are the signs worth knowing before it happens to you:
- Redirects to spam. Visitors, often just the ones on mobile or arriving from Google, get bounced to gambling, pharma, or adult pages. This is the single most common symptom, showing up in roughly 7 of every 10 hacked sites, and it is sneaky because it often leaves you, the logged-in owner, alone.
- A red Google warning. "Deceptive site ahead" or "This site may be hacked" under your search result. Once Google flags you, your traffic falls off a cliff, and it does not come back the moment you clean up.
- Spam pages under your domain. Suddenly there are hundreds of pages about products you do not sell, indexed by search engines as if they were yours.
- Strange admin users. A new administrator account with a garbled name or a throwaway email you never created. That is a backdoor.
- Gibberish in your files. Long strings of base64-encoded nonsense at the top of PHP files, especially index.php, wp-config.php, and your theme's functions.php.
- PHP files in your uploads folder. Nothing executable should ever live in /wp-content/uploads/. It is for images. If there is a .php file in there, someone put it there.
If it already happened, do this
Panic makes it worse. Work through it in order. If any of this is beyond your comfort level, this is exactly the point to bring in someone who does it for a living, because a half-clean hacked WordPress site gets reinfected within days.
- Put the site in maintenance mode. Protect visitors from the malware and stop the attacker from doing more while you work.
- Change every password. WordPress admin, hosting panel, SFTP and SSH, the database, and any email tied to password resets. Assume all of them are compromised.
- Take a full backup before you touch anything. It may get worse before it gets better, and you want a snapshot to compare against.
- Clean, do not patch over. Replace WordPress core files with fresh copies, remove the compromised plugins and themes entirely, and clean the injected code out of the database.
- Check the usual hiding spots. Read your .htaccess file carefully, because attackers love to plant redirect rules there, and scan the uploads folder for any PHP that should not exist.
- Ask Google to re-review. If you were blacklisted, request a security review in Google Search Console. It re-scans and lifts the warning once it confirms you are clean, then resubmit your sitemap so it recrawls the good pages.
- Watch for two weeks. Reinfection usually shows up within the first 10 to 14 days. Keep an eye on your logs for repeated hits on wp-login.php and xmlrpc.php, and on Search Console for stray spam URLs creeping back.
WordPress security is almost entirely maintenance
Here is the good news and the annoying news at once: nearly all of this is preventable, and the prevention is boring. It is not one clever product. It is a handful of habits kept up consistently.
- Delete what you do not use. Every plugin and theme you are not actively using is attack surface for zero benefit. Deactivating is not enough. The code still sits on the server. Remove it.
- Update on a schedule, not a whim. Core, plugins, and themes, checked regularly. Remember, a patch only protects you once it is applied, and half of all breaches are just unapplied patches.
- Avoid abandoned plugins. Abandoned code is where plugin vulnerabilities live the longest, with no fix ever coming. Before you install something, check when it was last updated. If it has been over a year, walk away. If a plugin you rely on gets abandoned, find a maintained replacement, or have the feature built into the site properly, before it becomes the hole.
- Put a firewall in front of the site. A web application firewall blocks a lot of automated attacks at the edge, which matters most on cheaper hosting that does not do it for you.
- Keep real backups off-site. Tested, off-site backups turn a disaster into an inconvenience. Restoring beats cleaning almost every time.
- Lock down logins. Strong admin passwords, two-factor, and limits on login attempts kill a big chunk of the automated brute-force noise.
None of it is hard. It just has to actually get done, month after month, which is precisely the part that slips when you are busy running a business. That is the real reason WordPress security fails. Not ignorance. Neglect that nobody chose.
Where a maintenance partner earns its keep
We built a monitoring and update routine for a client whose site had been hacked twice through the same kind of forgotten plugin. Both times it was cleaned, and both times it got reinfected because nothing changed underneath. The problem was never the cleanup. It was that no one owned the ongoing upkeep.
Once someone was watching, running the updates, pruning dead plugins, and keeping a firewall and clean backups in place, the reinfections stopped. That is the whole value of managed WordPress development and maintenance: not heroics after a breach, but the dull, reliable upkeep that keeps the breach from happening in the first place.
Frequently Asked Questions
How do I tell if a plugin is abandoned before I install it?
Check the plugin's page in the WordPress directory before you commit. Look at the "last updated" date and the "tested up to" version. If it has not been touched in over a year, or it has not been tested against a recent WordPress release, treat that as a warning and find a maintained alternative. Abandoned code is where plugin vulnerabilities live the longest, because no fix is ever coming.
My site looks fine to me. How would I even know it has been hacked?
Many hacks deliberately hide from the logged-in owner, so "it looks fine when I check" means little. Redirects often only trigger for mobile visitors or people arriving from Google. Watch for a "this site may be hacked" warning under your search result, spam pages indexed under your domain, admin accounts you did not create, and PHP files sitting in your uploads folder where only images belong.
Is a security plugin like Wordfence enough to protect my site?
A security plugin helps, but it is one layer, not the whole answer. It cannot patch a plugin you never update or remove code that was abandoned by its developer. Real WordPress security is mostly maintenance: deleting what you do not use, applying updates on a schedule, keeping a firewall at the edge, and holding clean off-site backups. The plugin supports those habits; it does not replace them.
Should I clean a hacked site myself or pay someone to do it?
If you are comfortable replacing core files, removing compromised plugins, and cleaning injected code out of the database, you can work through it methodically. The catch is that a half-clean site gets reinfected within days, usually in the first 10 to 14 days. If any step is beyond your comfort level, bring in someone who does it for a living, because a missed backdoor undoes all the work.
How often do I actually need to run updates?
Often enough that a patch gets applied before bots exploit it, and that window is short. When a new vulnerability is disclosed, the median time before it is first exploited is about five hours. A regular schedule, weekly at least, beats waiting until something feels wrong. Remember that roughly half of breaches are just patches nobody applied, so the update is doing more than you would guess.
Does cheap hosting really make my site less secure?
Indirectly, yes. Budget hosting usually lacks the edge firewall that would block a lot of automated attacks before they ever reach your site. Combine that with a forgotten plugin and the roughly 90,000 attacks per minute hitting WordPress sites, and you have the exact recipe for a breach. Better hosting or a web application firewall in front of the site closes a big part of that gap.
If your site is running plugins you have not thought about in a year, or it already got hit and you are not sure it is truly clean, get in touch and we will take a proper look at your WordPress security. It is a lot cheaper than the second hack.