A design agency in Nashville lost three client sites in one week last November. Same attack vector on all three. A widely-used contact form plugin had a critical vulnerability disclosed on a Tuesday. Exploitation started in the wild by Wednesday afternoon. Two of the agency’s client sites were compromised by Friday. The third was hit the following Monday. All three sites were running the vulnerable plugin. None had been updated since the previous quarter because the agency did updates “when the client asks.”
This is the story of most WordPress hacks. Not sophisticated attackers finding zero-day exploits. Ordinary attackers scanning the internet for sites running vulnerable versions of common plugins, using scripts anyone can buy on Telegram for $50.
WordPress powers roughly 43% of all websites globally. That scale is what makes it the highest-value target for opportunistic attackers. The good news: 90% of successful compromises use known vulnerabilities with known fixes. Which means 90% of WordPress hacks are preventable with basic hygiene.
This is what that hygiene actually looks like.
The four attack vectors that account for almost everything
Almost every WordPress compromise traces to one of four vectors. Understanding which is critical because the defense for each is different.
The four attack vectors that account for almost all WordPress compromises
Vector | How It Works | Primary Defense |
Plugin vulnerabilities | Attacker scans for outdated versions of vulnerable plugins | Patching cadence, curated plugin selection |
Brute-force credentials | Automated password guessing against /wp-login.php | Strong passwords, 2FA, rate-limiting, hidden login URL |
Compromised admin machines | Malware on admin’s device steals session or credentials | Admin device hygiene, password manager, VPN |
Nulled or abandoned themes/plugins | Pirated software or unmaintained code contains backdoors | Only use reputable, actively-maintained software |
Plugin vulnerabilities: the biggest single risk
WordPress has roughly 60,000 plugins in the official directory and untold thousands more distributed elsewhere. Each is a potential attack surface. Vulnerabilities are disclosed weekly. Some are minor (information disclosure), some are critical (remote code execution, SQL injection, arbitrary file upload).
The pattern of exploitation is predictable: a vulnerability gets disclosed, often with a proof-of-concept exploit within days. Attackers scan the internet for vulnerable versions using tools like Shodan and specialized WordPress scanners. Sites that haven’t patched get hit within 12 to 72 hours of the disclosure.
The defense is boring but effective: patch on a schedule, and drop plugins you don’t actively need. Every plugin installed is a potential vulnerability, even if it’s currently secure. The safest plugins are the ones you removed.
Springbolt maintains a curated internal list of plugins we consider safe based on maintainer track record, audit history, and update responsiveness. When a client asks about installing something outside that list, we run a security review first. It’s not glamorous but it stops most of the bad outcomes.
Brute-force credential attacks: the low-hanging fruit
WordPress login pages are internet-facing by default. Attackers know this. They use automated tools to try thousands of common username and password combinations against every WordPress site they can find. If a site uses “admin” as the username and any password from a common leaked-password list, it will be compromised within days of exposure.
Defense against brute force is simple:
- Never use “admin” as a username
- Enforce strong, unique passwords for every admin account (14+ characters, generated)
- Enable two-factor authentication for every admin account
- Rate-limit login attempts (5 failures triggers a temporary lockout)
- Change the default /wp-admin URL to something non-obvious (security through obscurity is real value here even though purists complain)
Every one of these takes minutes to implement. Sites that skip them get compromised. It’s that simple.
Compromised admin machines: the vector nobody talks about
The other underappreciated risk: even a perfectly-secured WordPress site can be compromised if an admin’s personal machine gets infected with malware. Once the malware steals the admin’s browser session or captures their credentials as they log in, the attacker has legitimate admin access. No amount of server-side hardening prevents this.
Defense is admin hygiene: keep browsers and OS patched, use a password manager (not the browser’s built-in one for admin credentials), be paranoid about phishing, don’t work on client sites from public wifi without a VPN.
For agencies, the practical version: any device that touches client site admin panels needs the same security discipline as if it were a bank employee’s device. That’s a higher bar than most agencies actually hold themselves to.
Abandoned themes and nulled software: the invitation
“Nulled” themes and plugins are pirated commercial software with the license check removed and often with malicious code inserted by whoever posted them. Sites running nulled software are essentially opting into being compromised. The malicious code usually establishes persistent backdoor access before doing anything else, so even removing the theme later doesn’t necessarily clean the infection.
Abandoned themes and plugins (ones the developer stopped maintaining) are almost as dangerous. Vulnerabilities discovered in them never get patched. Any site still running them accumulates risk over time.
The rule: only run themes and plugins from active, reputable developers with recent updates. Never nulled. If a plugin hasn’t been updated in 12+ months, replace it with a maintained alternative even if it currently works.
What “security plugins” actually do
Sites often rely on plugins like Wordfence, Sucuri Security, or iThemes Security as their primary defense. These plugins do useful things: firewall rules, login hardening, malware scanning, file integrity monitoring. But they are not a substitute for the four disciplines above.
A security plugin on a site running an unpatched vulnerable contact form plugin will not stop the exploit. A security plugin cannot protect against a compromised admin credential. A security plugin cannot prevent malicious code planted in a nulled theme from executing.
Security plugins are a useful additional layer. They are not a strategy. The strategy is patching cadence, credential hygiene, curated plugin selection, and monitored file integrity. The plugin is a tool that helps implement some of those disciplines. It’s not the discipline itself.
The realistic maintenance cadence
For most WordPress sites, the working security maintenance cadence looks like this:
Weekly: WordPress core and plugin updates applied to a staging environment, tested, and pushed to production. Emergency out-of-band updates for critical vulnerabilities within 24 hours of disclosure.
Monthly: Audit installed plugins. Remove anything not actively used. Verify all backups are current and successfully restore in a test environment.
Quarterly: Review admin user list. Deactivate accounts for anyone who has left the organization. Force password rotation on all remaining admin accounts. Re-verify two-factor authentication is active for every admin.
Annually: Full security audit including file integrity check, database review, theme and plugin provenance verification, and hosting infrastructure review.
Most agencies and internal teams try to hit “monthly updates” and let the rest slide. That’s why 90% of hacks trace to preventable vulnerabilities. The full cadence is what actually keeps sites secure over years.
What Springbolt’s Website Monitor covers on the security side
Website Monitor handles the weekly and monthly cadence automatically. Core and plugin updates applied to staging, tested, pushed to production. Emergency out-of-band patching within hours for critical CVEs. Automated file integrity monitoring so any unauthorized change is flagged and investigated. Off-server backups stored in a separate region so ransomware or destructive attacks can be reversed by restoration.
The quarterly and annual disciplines are available as add-ons or as part of a broader engagement. Sites on the full protection service average less than one security incident per year across the 400+ site portfolio, and the incidents that do occur are typically resolved within hours.
The uncomfortable question
Ask whoever manages your WordPress site: when was the last vulnerability disclosure that affected your installed plugins, and how quickly was it patched?
If they can’t answer, or the answer is “we update when there’s a big issue,” you have unpatched vulnerabilities right now. Statistically. Not maybe. Not probably. Right now, sitting exposed, waiting for the next automated scan to find them.
The good news: fixing that is boring, doable, and can start today. The bad news: waiting until after an incident doubles the cost and often triples the recovery time.
The compounding value of not being hacked
Businesses that get hacked once often get hacked again within a year. The initial compromise usually leaves persistent backdoors that don’t get fully cleaned. Search engines de-rank compromised sites, sometimes for 6 to 12 months after cleanup. Customers who saw browser warnings when visiting a compromised site remember it.
The compounding cost of one WordPress compromise, measured against 12 months of preventive maintenance, is not close. Prevention wins by an order of magnitude. But it requires the boring monthly work almost nobody wants to do.
Frequently asked questions
What is the most common way WordPress sites get hacked?
Unpatched plugin vulnerabilities. Roughly 60% of WordPress compromises trace to outdated plugins with known, published vulnerabilities. Attackers scan the internet for sites running vulnerable versions and exploit within 12 to 72 hours of disclosure. Regular patching is the single most effective defense.
Are WordPress security plugins enough to protect a site?
No. Security plugins like Wordfence and Sucuri add useful protective layers, but they cannot substitute for patching, credential hygiene, or curated plugin selection. A security plugin on a site running an unpatched vulnerable plugin will not stop the exploit. The plugin helps implement discipline; it is not the discipline itself.
How quickly should WordPress vulnerabilities be patched?
For routine plugin and core updates, weekly cadence with staging validation. For critical CVE disclosures affecting installed plugins, within 24 hours. The average time from vulnerability disclosure to active exploitation is 12 to 72 hours, so sites without an emergency patching process are exposed for days at minimum.
What is a ‘nulled’ WordPress plugin and why is it dangerous?
A nulled plugin is pirated commercial software with the license check removed. Almost all nulled plugins contain malicious code inserted by whoever distributed them, usually establishing persistent backdoor access. Removing the plugin later does not necessarily clean the infection. Never install nulled software on a site you care about.
Should I use two-factor authentication on WordPress admin accounts?
Yes. Two-factor authentication blocks the vast majority of credential-based attacks even if the password is weak or compromised. Enable it for every admin account without exception. Plugins like Wordfence, Two Factor, or WP 2FA add this cleanly and take minutes to configure.
How do I know if my WordPress site has been hacked?
Common signs: unexpected admin users, unfamiliar files in the /wp-content/ directory, unexplained outbound traffic, browser warnings when visiting the site, Google Search Console flags for malicious content, sudden ranking drops, or reports of spam being sent from your domain. If any of these appear, treat the site as compromised until proven otherwise and start incident response immediately.
What does Springbolt’s Website Monitor include for WordPress security?
Weekly core and plugin updates applied to staging first, then production. Emergency out-of-band patching within hours for critical CVEs. Automated file integrity monitoring. Off-server backups in a separate region for restoration if a compromise occurs. Malware scanning and remediation. Sites on the full service average less than one incident per year across a 400+ site portfolio.