If you run a WordPress site, you’ve probably wondered at some point: Am I at risk?
The answer is yes. But not for the reason most people assume.
WordPress itself is not insecure. The core software is maintained by a large team and has had only a handful of vulnerabilities in recent years. The real problem lies in everything around it: the plugins you install, the passwords you choose, the hosting environment you rely on, and the updates you skip.
In this post, we’ll break down exactly why WordPress sites get hacked, where attackers actually get in, and what you can do to close those gaps.
Why WordPress Is Such a Big Target
WordPress powers over 43% of all websites on the internet. That scale is both its greatest strength and its biggest security liability.
Hackers rarely target a single specific site. Instead, they run automated scanning tools that probe millions of sites at once, looking for known vulnerabilities. When one is found, bots exploit it across every site running that same outdated version. It’s not personal. It’s efficient.
The sheer number of WordPress sites means that even a tiny percentage of vulnerable sites represents millions of potential targets. If your site has an unpatched plugin or a weak password, it will eventually be found.
The Most Common Entry Points
1. Outdated Plugins and Themes
This is the single biggest cause of WordPress hacks. 91% of WordPress vulnerabilities are found in plugins, not in WordPress core itself. When a plugin developer releases a security patch, they are publicly announcing that the previous version had a hole. Automated scanners immediately start looking for sites still running that version.
The window between vulnerability disclosure and active exploitation has shrunk dramatically. In many cases, attacks begin within hours of a patch being published.
Despite this, most site owners are slow to update. Plugins pile up, some get abandoned, and outdated versions accumulate quietly in the background while bots probe for them around the clock.
The fix is straightforward but requires consistency: plugins and themes need to be updated regularly, and unused ones should be deleted entirely, not just deactivated.At Webueno, plugin and core updates are handled as part of every Maintenance plan, on a daily, weekly, or monthly cycle depending on what your site needs.
2. Weak or Reused Passwords
Brute force attacks are exactly what they sound like: automated bots trying thousands of username and password combinations until one works. And they work more often than they should.
The most common WordPress username is still “admin”. Combined with a simple or reused password, this gives attackers an easy path straight into your dashboard.
Simply changing your username away from “admin” eliminates the majority of brute force attempts. Adding a strong, unique password and enabling two-factor authentication closes the door almost entirely.
3. Insecure Hosting Environments
Your hosting provider is part of your security posture. A server that is not properly configured, not monitored, and not isolated creates risk for every site running on it.
On shared hosting environments, one compromised site can affect neighboring sites through cross-site contamination. If another website on your shared server gets infected with malware, your site can be exposed through the same server environment, regardless of how well you’ve maintained your own WordPress installation.This is one of the core reasons Webueno runs each site on its own isolated server. Isolation means that what happens to one site cannot travel to another.
4. Nulled Plugins and Themes
Nulled software refers to paid plugins or themes that have been cracked and distributed for free on unofficial sites. They are extremely common and extremely dangerous.
Nulled plugins almost always contain backdoors: hidden pieces of code that give attackers persistent access to your site even after you think you’ve cleaned it. Installing a nulled plugin is essentially inviting malware in through the front door while believing you got a free product.
If you’re using any nulled plugins or themes, remove them immediately and replace them with legitimate licensed versions.
5. Exposed Login Pages
The WordPress login page at /wp-admin and /wp-login.php is one of the most targeted URLs on the internet. Bots hit it constantly, testing credentials around the clock.
Leaving it completely open and unprotected is an unnecessary risk. Basic measures like limiting login attempts, changing the default login URL, adding CAPTCHA, and enabling two-factor authentication significantly reduce your exposure.
6. Abandoned or Inactive Plugins
A plugin you installed two years ago and haven’t touched since is still running code on your server. If the developer stopped maintaining it or released an unpatched vulnerability, that plugin is an open door.Unused plugins should be deleted, not just deactivated. Deactivated plugins still exist in your file system and can still be exploited.
7. Misconfigured File Permissions
WordPress relies on a specific set of file and folder permissions to function correctly. When those permissions are too open, attackers can write, modify, or execute files on your server that they should never have access to.
The most common misconfiguration is setting file permissions to 777, which means anyone (including external scripts) can read, write, and execute that file. This often happens by accident during troubleshooting or when following outdated tutorials online.
Correct WordPress file permissions are:
- Folders: 755
- Files: 644
- wp-config.php: 440 or 400 (the most sensitive file on your installation)
The wp-config.php file deserves special attention. It contains your database credentials, security keys, and table prefix. If an attacker can read or modify it, they have everything they need to take full control of your site. It should be restricted as tightly as possible and ideally moved one directory above your WordPress root.
Misconfigured permissions are rarely intentional but are consistently exploited. A routine security audit will catch these before they become a problem.
8. No SSL or Mixed Content Issues
An SSL certificate encrypts the data that travels between your website and your visitors. Without it, any information submitted through your site (contact forms, login credentials, payment details) can be intercepted in transit.
But having an SSL certificate installed is not always enough. Mixed content occurs when a site loads over HTTPS but still pulls some resources (images, scripts, stylesheets) over HTTP. Browsers flag this, trust signals break down, and in some configurations, it creates actual security gaps that can be exploited.
Mixed content is particularly common after a site migration or a domain change, where internal links and asset URLs haven’t been fully updated. It can also appear after installing a new plugin that references HTTP resources.
Beyond the direct security implications, a site flagged as “Not Secure” by Chrome loses visitor trust immediately. For a business site, that means lost conversions before the page even loads.
Fixing mixed content requires a full audit of all resource URLs and a proper HTTP to HTTPS redirect setup, including updating all hardcoded links in your database.
How Attackers Actually Find Your Site
Most people imagine a hacker sitting at a computer, manually targeting their website. The reality is far less cinematic and far more difficult to defend against.
The vast majority of WordPress attacks are fully automated. Attackers deploy large networks of bots that continuously scan the entire internet, not looking for your site specifically, but looking for any site running a vulnerable version of a plugin, a weak login endpoint, or an exposed configuration file. Your site is one of hundreds of millions being probed simultaneously, around the clock, every single day.
When a bot finds a match, it flags the site and either exploits it immediately or adds it to a list for a larger coordinated attack. The process takes seconds. By the time you notice unusual traffic in your logs, the initial scan has already moved on to thousands of other targets.
This is why the advice “my site is too small to be a target” is dangerously wrong. Here is what automated bots are actually scanning for on every site they hit:
- Outdated plugin versions matched against public vulnerability databases
- Default login URLs (/wp-admin, /wp-login.php) with no rate limiting
- Exposed wp-config.php or backup files left in the web root
- Directory listing enabled on folders like /wp-content/uploads/
- XML-RPC endpoint left open and unprotected
- Readme.html files that reveal the exact WordPress version number
Weak or default credentials are tested through automated brute force
| What Bots Look For | Why It Matters |
|---|---|
| Outdated plugin versions | Matched instantly against known CVE databases |
| Default login URL | No rate limiting means unlimited brute force attempts |
| Exposed wp-config.php | Contains database credentials and secret keys |
| Directory listing enabled | Reveals file structure and sensitive paths |
| XML-RPC open | Can be used for brute force and DDoS amplification |
| Readme.html present | Exposes the exact WordPress version to scanners |
| Weak credentials | Brute forced in minutes with common password lists |
Understanding this changes how you think about WordPress security. It is not about whether someone will try to hack your site. It is about whether they will succeed when they do.
What Happens After a Site Gets Hacked
Understanding the entry points is one thing. What makes modern WordPress attacks particularly difficult is what happens after the initial breach.
Attackers rarely just break in, cause visible damage, and leave. Modern malware is designed to be persistent and silent. It installs backdoors, injects code into legitimate files, and in some cases runs memory-resident scripts that automatically rewrite cleaned files the moment you restore them.
This is why simply deleting infected files often doesn’t solve the problem. If the original vulnerability is still open and the malware has embedded itself deeply enough, the infection comes back within hours.Effective cleanup requires three things: removing all infected code, patching the original entry point, and verifying that no persistence mechanisms remain. Webueno’s Malware Cleanup service handles all three, and the built-in Malware Scanner monitors your site continuously so issues are caught before they escalate.
The Human Factor: Trusted Access Gone Wrong
Not every WordPress hack starts with a bot. Some of the most damaging ones start with a friendly email.
A common and underreported attack vector is social engineering through fake service offers. Someone reaches out offering free SEO, a free audit, or a quick optimization. The site owner gives them WordPress admin access to “take a look.” The person installs a plugin, makes a few changes, and leaves. What they also leave behind is a backdoor.
This is particularly dangerous for a few reasons:
- The access was willingly granted, so there are no failed login attempts or suspicious IPs to trigger alerts
- The malware installed is often custom-written, meaning standard scanners will not detect it. Off-the-shelf security plugins match against known malware signatures. A custom payload has no signature to match against.
- The backdoor can sit dormant for weeks or months before being used, making it nearly impossible to trace back to the original access
Common scenarios where this happens:
- Cold emails or DMs offering free SEO, speed optimization, or “I noticed a problem with your site.”
- Freelancers or contractors are given admin access and never removed after the project ends
- Plugins installed by a former developer that are no longer maintained or monitored
The rule is simple: never give WordPress admin access to someone you haven’t vetted, and always remove access immediately after a project ends. Audit your user list regularly and delete any accounts that should not be there.
One more important note from practice: if a site does get infected, the correct approach is not just to clean the files. Clean the site, move it to a new server, and replace all old components. Custom malware in particular embeds itself at a level that makes full confidence in a cleaned-but-same-server setup unrealistic.
How to Reduce Your Risk Starting Today
You don’t need to do everything at once. Start with the highest-impact actions:
- Update all plugins and themes, and delete anything you’re not actively using
- Change your admin username if it’s still set to “admin.”
- Use a strong, unique password for your WordPress account and your hosting panel
- Enable two-factor authentication on your login page
- Move to an isolated hosting environment where your site is not sharing a server with hundreds of others
- Run a malware scan to check if anything is already compromised
The Bottom Line
WordPress sites get hacked not because WordPress is broken, but because maintaining a secure site requires ongoing attention. Outdated plugins, weak passwords, shared hosting environments, and abandoned software are the entry points attackers rely on.
The good news is that most of these risks are entirely preventable with the right setup and consistent maintenance.
If you want a hosting environment that’s built with security in mind from the start, and a maintenance service that keeps your site updated and monitored, Webueno’s managed WordPress hosting is designed exactly for that.
Start for free and see what a properly maintained WordPress site looks like
