Why WordPress sites get hacked.
Not because WordPress is weak. Because nobody is watching. Here is how attackers actually get into small business sites, and the routine work that keeps them out.
Four ways in.
Small business sites are rarely targeted by a person. They're found by bots that scan millions of sites for the same few weaknesses, all day, every day.
Stolen or reused passwords
The most common way in. A password leaked from some other website gets tried on yours, and bots try thousands an hour.
Most common
Old plugins
A plugin with a known hole that nobody updated, or one its maker abandoned years ago.
Planted fake plugins
Once inside, attackers install a plugin with a harmless-sounding name that lets them back in whenever they like.
Forgotten admin accounts
Logins for a past employee, a past developer or nobody at all, still with full access.
What maintenance changes.
None of this is exotic. It's routine work done every month, by someone whose job it is.
Maintained
- Updates applied the month they ship, and the site tested afterward
- Every security alert read and sorted, with sign-ins from abroad flagged at once
- Admin accounts reviewed when we take a site on
- Daily backups in three separate places
- A team that notices when something changes
Left alone
- Updates applied when someone remembers, or never
- Alert emails pile up unread
- Old logins left active for years
- One backup on the same server, if any
- You find out from a customer or from Google
Questions we hear.
Is WordPress insecure?
No. WordPress itself is patched quickly. Most break-ins come through weak or reused passwords, out-of-date plugins and accounts nobody removed, which is exactly what regular maintenance covers.
How do I know if my site has been hacked?
Sometimes you don't, which is the problem. Common signs are visitors redirected to spam sites, Google warnings in search results, admin users you don't recognize, and plugins you never installed. If any of those sound familiar, get it checked.
What should I do if my site has been hacked?
Change every password, don't delete anything yet, and get help. The evidence of how they got in is what stops it happening again.
Would a custom-coded site avoid this?
It removes the biggest risk: there are no plugins to fall behind on. That's one reason we build some sites in custom code.
Keep reading.
Worried about your site?
Tell us the address. We'll check it from the outside and tell you honestly what we see.
