WordPress Security: What Actually Gets Sites Hacked
WordPress core is rarely the problem. Outdated plugins, reused passwords and forgotten admin accounts are what let attackers in, and the fixes are mostly free. Here is what actually happens, how to spot it, and what to do on the day you find out.
WordPress core is rarely what gets hacked. In nearly every compromised site we have cleaned up, the way in was an outdated or abandoned plugin, a reused admin password, or a hosting account that was already breached. Keep plugins current, use unique passwords with two factor, delete what you do not use, and you have shut most of the door.
Nobody breaks in the way films show it. It is automated: a script crawling millions of sites, checking each against a published list of vulnerable plugin versions, then walking through the hole it finds. Your site was never targeted, it was on the list. You do not need threat intelligence. You need to stop being the easy one.
How do WordPress sites actually get hacked?
A handful of causes account for almost every cleanup we do. In rough order of how often we see them:
- An outdated plugin with a known vulnerability. The flaw gets published, a patch ships that week, thousands of sites never install it. Booking plugins, form builders and page builder add-ons are the usual suspects because they are everywhere.
- A plugin or theme abandoned by its developer. Still installed, still active, no update in three years. Worse than an outdated one, because no patch is coming.
- Nulled or pirated premium plugins. If you downloaded a paid theme from a site offering it free, assume there is a backdoor in it. That is the business model, not a coincidence.
- Reused passwords, with no two factor and no limit on login attempts. Your admin password was also used on a forum breached in 2019, attackers buy those lists, and a bot can guess for a week unnoticed.
- An old admin account nobody removed. The developer you used in 2021, the staff member who left. Full privileges, a password set years ago.
- A compromised hosting account, worse than a compromised site because it usually means every site on it. The entry point is often the owner’s laptop or email, not the server.
- An outdated PHP version. Sites still on PHP 7.4, unsupported since November 2022, get no patches for the language itself.
WordPress core is not on that list. Core is audited hard and patches ship fast. The tens of thousands of plugins in the directory are another matter, and that is the trade-off for the flexibility.
Which risks matter most, and what does fixing them cost you?
Some risks are almost certain to bite you and take fifteen minutes to fix. Others get talked about at conferences and rarely cause a real incident. Here is how we rank them.
| Risk | Likelihood | Fix | Effort |
|---|---|---|---|
| Outdated plugin with a published vulnerability | Very high | Update monthly at minimum; delete anything not actively used | 20 min a month |
| Nulled or pirated premium plugin or theme | High, if one is present | Delete it, buy the real licence or switch to a maintained alternative | 1 hour plus licence cost |
| Reused or weak admin password | High | Unique 20 character password per site, kept in a password manager | 20 min, once |
| No two factor on admin accounts | High | Enable 2FA for every user with publishing rights | 10 min per person |
| Abandoned plugin, no update in 2+ years | Moderate to high | Replace with a maintained equivalent | 1 to 3 hours |
| Old admin accounts still active | Moderate | Audit users quarterly, delete or demote to subscriber | 10 min a quarter |
| Unlimited login attempts on wp-login.php | Moderate | Rate limit logins, or put Cloudflare in front of the site | 30 min, once |
| Outdated PHP version | Moderate | Move to a supported release (PHP 8.2 or later), test afterwards | 1 hour with testing |
| No offsite backup you have actually restored from | Low as an entry point, severe as an outcome | Daily offsite backup plus one test restore | Setup once, roughly $0 to $20 a month excluding GST |
| Loose file permissions | Low on decent hosting | 644 for files, 755 for folders, 600 for wp-config.php | 15 min, once |
The pattern is hard to miss. The things most likely to get you are the cheapest to fix, and they are boring.
What do attackers actually do once they are in?
Almost never what owners expect. They rarely deface the homepage, because a defaced site gets fixed the same day and the access is lost. Quiet access is worth more.
The usual outcomes are spam page farms, a few thousand pages in a folder you never created selling pharmaceuticals or replica watches, and SEO injections: hidden links pushed into your existing pages, cloaked so they are served to Googlebot and not to you. Which is why the site looks fine when you check it. Redirects are nastier again. A well built one fires only for mobile visitors arriving from Google, so nothing looks wrong for weeks while your traffic lands on a scam page.
On WooCommerce, the one to genuinely fear is a card skimmer: a few lines of JavaScript on the checkout reading the card number as it is typed and posting it offshore. Orders still complete. You find out when your payment provider rings. Then the mundane one, where your server is used to send spam and your sending IP is blacklisted. We have had clients discover a compromise because email started bouncing, not because the website looked odd.
How can you tell if your site has already been hacked?
Most owners find out from a third party rather than from looking. Run these checks yourself, it takes ten minutes.
- Google Search Console. A Security Issues notification sitting there is your answer.
- Search site:yourdomain.com.au in Google and page through. Pages you did not create, in languages you do not speak, are the giveaway.
- Users, then All Users, sorted by registration date. Any administrator you cannot name is a problem.
- File modification dates in your hosting file manager. Core files changed last Tuesday, when you did not touch the site, is worth investigating.
- Load your own site on a phone over mobile data, arriving through a Google search rather than typing the URL. This catches conditional redirects.
- Ask your host whether outbound mail volume or CPU use has spiked.
Be careful with scanner output. Plugin scanners throw false positives constantly. Modified core files are the signal worth acting on.
What hardening is genuinely worth doing?
This is the whole list for a typical Australian small business site. It is short, and most of it is free.
- Update core, plugins and themes on a schedule. Monthly is the floor, fortnightly is better, same week for anything flagged as a security release. Back up first.
- Delete every plugin and theme you are not using. Deactivated is not deleted, and dormant code can still be reachable. Most sites we audit carry four or five nobody has touched in years.
- Unique passwords everywhere, generated by a password manager, not a pattern with the site name in it.
- Two factor on every administrator account, on the hosting control panel, and on the email address that can reset both. That email is the master key and people forget it.
- Limit login attempts, and put Cloudflare in front of the site (the free tier is fine) so junk traffic is filtered before it reaches your server.
- Correct file permissions: 644 on files, 755 on directories, 600 on wp-config.php. Never 777, whatever a forum post from 2014 told you.
- Daily offsite backups with 30 days of history, kept somewhere other than the server they came from. Then restore one to staging to prove it works. An untested backup is a hope, not a plan.
- Keep PHP on a supported version.
None of it is exotic. It is the same list we work through on the sites we look after, and roughly what you pay for with managed Australian WordPress hosting.
Rule of thumb: if a plugin has not been updated in two years, or its author has stopped replying in the support forum, treat it as a liability whether or not it works. Replacing it on a quiet Tuesday costs a couple of hours. Replacing it after a breach costs a couple of thousand.
Are security plugins worth installing, or are they oversold?
Both. Wordfence, Sucuri and Solid Security all do genuinely useful things, and all of them are marketed harder than the actual protection warrants.
What is real: login rate limiting, two factor, alerts when core files change, a scan comparing your files against the official versions, and a log of who logged in and when. That last one matters more than people realise during a cleanup, because it tells you which backup is clean.
Where they are oversold is the word firewall. A plugin firewall runs inside PHP, after WordPress has begun loading, so the request has already reached your server. It protects the application, not the server, and does nothing if the attacker came in through your hosting account. Edge filtering drops traffic before it arrives. Not equivalent. Scanners have the reverse problem: they find the aftermath, they do not prevent it. One security plugin per site, plus edge filtering. Two plugins mostly slows the site and generates alerts you learn to ignore.
What do you do the day you find out you have been hacked?
Move in this order, and resist the urge to start deleting suspicious looking files.
- If the site takes payments or collects personal information, put it into maintenance mode now. A few hours of downtime beats another day of harvesting card details.
- Change every password from a device you trust: hosting, WordPress admins, FTP and SSH, database, and the email tied to it all. Doing this from a compromised laptop achieves nothing.
- Delete unknown administrator accounts and check for cron jobs you did not create. Reinfection usually comes from a backdoor left behind, not a second break-in.
- Restore a backup from before the compromise rather than picking malware out by hand. Login logs tell you how far back clean actually is.
- No clean backup? Reinstall core and every plugin from official sources and inspect anything custom in wp-content. Budget half a day to two days.
- Rotate API keys and payment gateway credentials, and force a password reset on customer accounts.
- Request a review in Search Console once you are clean, or the warning stays in the search results.
- Watch closely for a fortnight. Most reinfections surface inside ten days.
Cost if you hand it over: a few hundred dollars excluding GST on a brochure site, four figures on a WooCommerce site with a skimmer and no usable backups. Set that against monthly maintenance and the maths makes itself. More in our WordPress and hosting guides.
Do you have to tell anyone if customer data was exposed?
Possibly, and this is where a website incident becomes a legal one. Australia’s Notifiable Data Breaches scheme, part of the Privacy Act 1988 and overseen by the OAIC, requires covered organisations to notify affected individuals and the OAIC when a breach is likely to cause serious harm. Covered means most businesses turning over more than $3 million, plus all health service providers regardless of size.
If your site holds names, contact details, health information or payment details and you cannot rule out that they were accessed, you have 30 days to assess and must notify promptly if the threshold is met. Not knowing what was taken does not exempt you, which is why logs matter: they are how you establish scope. We are not lawyers, so get proper advice rather than guessing. The practical version is to collect less and keep it for less time.
Know where responsibility sits. Your host secures the server, the network and the PHP version. You, or whoever maintains the site, own the plugins, themes, users and passwords. Most breaches happen on that second half. If you would rather one team held both, that is what our hosting and maintenance plans are built for, no lock-in contract.
Common questions
Does moving to a more expensive host make my site more secure?
It helps at the margins, not at the core. Better hosting gives you isolated accounts, current PHP, server level firewalls and faster restores, which all matter. But no host can stop you running a vulnerable booking plugin from 2021 or using the same password you used on a forum that got breached. Hosting secures the building. Plugins, users and passwords are the front door, and that part stays yours.
Should I hide the fact my site runs WordPress?
Not worth the effort. Removing the generator tag and renaming folders is trivially defeated: automated scanners fingerprint sites by looking for known file paths and script names, which you cannot practically remove without breaking things. Security through obscurity buys you nothing measurable here. Spend the same hour deleting unused plugins and enabling two factor instead. That actually changes the outcome.
How often should WordPress updates actually be applied?
Monthly as an absolute minimum, fortnightly if the site earns money, and within days for anything the developer flags as a security release. Take a backup first and check the site afterwards, particularly forms and checkout. Automatic updates for minor core releases are safe and on by default. Automatic updates for every plugin are a judgement call: fewer vulnerable windows, but a higher chance of waking up to a layout that has broken.
Can a hacked site be fully cleaned, or should I rebuild?
Most can be cleaned properly, especially with a clean backup to restore from. Rebuild when the site is old, nobody knows what half the plugins do, there are no usable backups, or it has been reinfected twice already. At that point you are spending cleanup money repeatedly on something you do not trust. Rebuilding a small business site costs more upfront but ends the cycle, and you get a current codebase out of it.
Do I still need backups if my host says they take them?
Yes, and check two things: how far back they go, and whether the copies live on the same server as your site. Many host backups are a single nightly snapshot kept for seven days, stored locally. If a compromise went unnoticed for three weeks, every one of those snapshots is infected. Keep your own offsite copies with 30 days of history, and restore one occasionally to confirm it actually works.
Is WooCommerce less secure than a normal WordPress site?
WooCommerce itself is well maintained. The risk rises because of what surrounds it: more plugins, more third party integrations, customer accounts, and stored personal information that makes the site worth attacking rather than just worth using. A card skimmer on a checkout page is the single worst outcome we deal with. If you sell online, treat updates, two factor and offsite backups as non-negotiable rather than nice to have.
Want someone to check whether your site is exposed?
Send us your domain and we will look at plugin versions, PHP, admin accounts and backups, then tell you plainly what needs fixing and what does not. Australian support, no lock-in contracts, and we have been maintaining WordPress sites since 2004.