How WordPress Sites Get Hacked (And How to Stop Each Attack)

Your WordPress site probably will not be hacked by a genius in a hoodie targeting you personally. Understanding how WordPress sites get hacked is far less glamorous than the movies suggest: the overwhelming majority of attacks are automated, opportunistic and aimed at whichever sites left a door open. In this post we break down the four entry points behind most WordPress compromises and show you exactly how to close each one, usually in minutes.

• Almost all WordPress hacks are automated and opportunistic, not personal or sophisticated
• 91% of new WordPress vulnerabilities found in 2025 were in plugins, with only six low-priority issues in WordPress core
• The four most common entry points are outdated plugins and themes, weak or reused passwords, forgotten admin accounts and insecure hosting
• Routine defenses such as updates, strong passwords, login protection and two-factor authentication stop the vast majority of attacks
• Prevention is not enough on its own; you also need a way to detect anything that slips through

WordPress powers over 40% of the web, so one working exploit can be replayed against millions of sites. Attackers are not usually after your content. They want to send spam from your server, inject SEO spam links, distribute malware to your visitors or recruit your site into a botnet.

That scale is why attacks are automated. Bots scan the entire internet for known weaknesses around the clock, which means an unpatched site gets found whether or not anyone has heard of it.

This is the number one cause of WordPress compromises, and it is not close. According to Patchstack’s State of WordPress Security in 2026, 11,334 new vulnerabilities were recorded in the WordPress ecosystem in 2025, and 91% of them were in plugins. WordPress core itself accounted for just six low-priority issues.

The attack pattern is always the same. A vulnerability in a plugin or theme is publicly disclosed, a patch is released and bots immediately start scanning for sites that have not applied it. The window is brutal: mass exploitation can begin within hours of disclosure.

How to close this door:

• Update plugins, themes and WordPress core promptly, or enable automatic updates for anything you do not test manually
• Delete deactivated plugins and themes entirely, since their code can still be exploited while it sits on your server
• Avoid abandoned plugins that have not been updated in over a year and never install nulled (pirated) plugins or themes

Automated scripts test millions of leaked username and password combinations against WordPress login pages every day. If a password you use has ever appeared in a data breach, a bot somewhere is trying it against your site right now. This is not an exaggeration: in a single year, Wordfence reported blocking tens of billions of password attacks across the WordPress ecosystem.

Remember that your site has more than one set of keys. Your hosting control panel, SFTP account, database and admin email all unlock the same kingdom.

How to close this door:

• Use a long, unique password for every account connected to your site, stored in a password manager
• Enable two-factor authentication for all users who can log in, especially administrators
• Turn on login lockout so an IP address is blocked after a few failed attempts, and consider hiding your login page from bots entirely

Every admin account is a door into your site, and old doors get rusty. The developer who built your site three years ago, the intern who left last summer, the shared “admin” login everyone knows: each one is an entry point that no amount of firewall rules can protect if the credentials leak.

Attackers love these accounts because using them does not look like an attack. It looks like a normal login.

How to close this door:

• Audit your users list quarterly and delete or downgrade accounts that no longer need access
• Apply the principle of least privilege, so editors are editors and not administrators
• Never use “admin” as a username and never share one account between multiple people

Less common than the first three, but a badly configured server can undo everything your site does right. Outdated PHP versions no longer receive security patches, overly permissive file permissions let attackers modify your files, and cheap shared hosting can allow one compromised site to infect its neighbors.

How to close this door:

• Choose a reputable host and run a supported PHP version (8.x)
• Set file permissions to 644 and folder permissions to 755, and block direct access to wp-config.php
• Use SFTP instead of plain FTP when transferring files

Almost every hacked site we see was hit by a bot exploiting a plugin flaw that already had a patch. Update automatically, turn on login lockout and 2FA, and you stop being the easy target the bots are scanning for.

Notice what is missing from everything above: sophistication. Because attacks are opportunistic, routine defenses genuinely work. Here is the order we recommend:

1. Update everything, then remove plugins and themes you do not use
2. Change any password that is short, reused or shared, starting with admin and hosting accounts
3. Enable login lockout, two-factor authentication and a firewall at the site level
4. Review your users list and remove anyone who should not be there
5. Set up monitoring, such as an activity log and malware scanning, so you find out quickly if something slips through

WordPress sites get hacked through a handful of predictable, preventable entry points: unpatched plugins, weak passwords, forgotten accounts and sloppy hosting. None of them require an attacker with skill, which means none of them require heroics to defend against. Close the four doors above and you are already ahead of the crowd the bots are looking for.