WordPress powers 43% of the web. That makes it the most targeted CMS for automated attacks, not because WordPress is uniquely insecure, but because the attack surface is enormous. Most WordPress sites are compromised not through sophisticated exploitation but through three common failures: outdated software, weak credentials, and vulnerable plugins.
Understanding why sites get hacked tells you where to focus your security effort.
How WordPress sites actually get hacked
The Wordfence threat intelligence team analyzed thousands of compromised WordPress sites and found the breakdown consistently points to a few sources:
- Vulnerable plugins and themes (56%): Outdated or poorly coded plugins with known CVEs are the #1 attack vector. Attackers scan for specific plugin versions with known vulnerabilities and exploit them automatically.
- Weak or compromised credentials (16%): Brute force attacks against /wp-login.php, credential stuffing using breached passwords from other sites, and poor password hygiene.
- Misconfigured hosting environment (9%): World-writable file permissions, unprotected wp-config.php, exposed phpMyAdmin, and other server configuration issues.
- Supply chain attacks (7%): A legitimate plugin that was abandoned or sold is updated with malicious code. The malicious update installs on every site that auto-updates.
- Other (12%): Social engineering, stolen FTP credentials, malicious code introduced during development.
The practical implication: keeping plugins updated and using strong passwords addresses 72% of the attack surface. Security plugins, firewalls, and advanced hardening address the remaining fraction.
Step 1: Plugin and theme hygiene
Apply updates promptly, within 24-48 hours for critical security releases. Wordfence’s email alerts and Patchstack’s free tier notify you of new CVEs in plugins you’re running, often before WordPress.org pushes the update.
Remove plugins and themes you’re not using. An inactive plugin that isn’t updated is still an attack surface. It’s just not running. Delete it entirely, don’t just deactivate it.
Be selective about plugins you install. Check when the plugin was last updated (over a year ago is a yellow flag, over two years is a red flag). Check that it has been tested with recent WordPress versions. Check the active installation count, popular plugins are more likely to be maintained and security-audited.
Auto-updates: Enable automatic minor WordPress core updates. For plugins, consider enabling auto-updates with a staging environment that tests updates before they hit production. If you can’t test, at minimum auto-update security-only releases.
Step 2: Authentication hardening
Use strong, unique passwords. Admin accounts with dictionary passwords or reused credentials from other sites are the easiest possible attack target. A 20+ character random password on the admin account eliminates most brute force risk.
Enable two-factor authentication. Even if credentials are compromised, 2FA prevents access. WP 2FA (free) or the 2FA built into Wordfence/iThemes Security handle this. This is non-negotiable for any site that handles customer data or payments.
Limit login attempts. The wp-login.php endpoint is hit by automated brute force bots constantly. Rate limiting failed login attempts stops these cold. Wordfence’s free tier or WP Cerber both handle this.
Change the default admin username. Admin/password is still being tried by bots in 2026. Using a non-guessable username for admin accounts eliminates the easiest credential attack.
Step 3: Hosting and server hardening
PHP version: Run PHP 8.1 or higher. Old PHP versions have known vulnerabilities and reduced performance. Check your host’s dashboard, changing PHP version is usually a one-click operation.
File permissions: WordPress directories should be 755, files should be 644, and wp-config.php should be 440 or 400. World-writable permissions (777) on directories are a serious vulnerability, a compromised PHP process can write files anywhere.
Protect wp-config.php: Add to your .htaccess:
<Files wp-config.php>
order allow,deny
deny from all
</Files>Disable XML-RPC if you’re not using it (most sites don’t). XML-RPC is a legacy remote publishing API that’s commonly abused for brute force attacks and DDoS amplification. Add to functions.php:
add_filter('xmlrpc_enabled', '__return_false');Step 4: Web application firewall
A WAF sits between internet traffic and your WordPress site, blocking known attack patterns before they reach PHP or the database. SQL injection, XSS, file inclusion attacks, and known exploit patterns are blocked at the firewall layer.
Two good options:
- Cloudflare WAF – operates at the DNS/CDN layer, so attacks are blocked before they reach your server. Cloudflare’s free tier includes basic WAF rules. Pro ($20/month) adds managed rulesets for WordPress specifically.
- Wordfence – a WordPress plugin that provides WAF and malware scanning. Blocks threats at the WordPress application layer. Free tier is effective; Premium adds real-time rule updates.
For best coverage: Cloudflare at the DNS layer blocking volumetric attacks and known IP threats, Wordfence at the application layer catching anything that gets through. Both on the same site is not redundant. They protect different things.
Step 5: Backups you can actually restore from
When everything else fails, and sometimes it does, a clean backup is your recovery path. The requirements for a useful backup:
- Daily automated backups at minimum, hourly for e-commerce with frequent orders
- Stored off-site, a backup stored on the same server as your site is lost when the server is compromised
- Both database and files, the database has your content, the files directory has uploads and plugins
- Tested, a backup you’ve never restored from is a backup you don’t know works
UpdraftPlus (free, stores backups to Google Drive or S3), BlogVault, and ManageWP all provide reliable automated backups. Managed WordPress hosts like Kinsta and WP Engine include daily backups in their plans.
Step 6: SSL and HTTPS
HTTPS encrypts traffic between your visitor’s browser and your server. Without it, passwords, form submissions, and payment details are transmitted in plaintext. Let’s Encrypt provides free SSL certificates, and every reputable host provides one-click SSL installation. There’s no reason a WordPress site in 2026 should be running on HTTP. Verify with a browser security check that your SSL is properly configured, expired or mixed-content SSL causes browser warnings that destroy conversion rates.
Step 7: Security monitoring and alerts
You want to know when something goes wrong before your visitors or Google do. Configure:
- Uptime monitoring – Betteruptime or UptimeRobot (free) alerts you within a minute of your site going down
- Malware scanning – Wordfence scans files weekly and alerts on file changes
- Google Search Console alerts – GSC notifies you if Google detects malware or manual actions
- Activity logs – WP Activity Log records who changed what in the admin, which helps reconstruct a compromise
What not to waste time on
Security theater is common in WordPress advice. These things feel like security but have minimal real impact:
- Hiding the WordPress version – attackers can determine your version from dozens of other signals. Hiding it from the generator meta tag does almost nothing.
- Renaming wp-admin – security through obscurity. Attackers have tools that find login pages regardless of URL. Focus on hardening the login instead.
- Disabling the REST API – many plugins and features depend on it. Disabling it globally breaks things without meaningfully improving security.
Need professional WordPress security?
We offer security hardening, malware removal, and ongoing security monitoring. If your site has been compromised, we also handle cleanup and post-incident hardening.
