WordPress powers a large share of the web, and that popularity makes it a constant target. But in almost every hacked WordPress site we have cleaned up, the core WordPress software was not the problem. The cause is almost always something around it.
The real causes we see most often
Outdated plugins and themes.
Old versions with known, published vulnerabilities are the single biggest cause of hacked WordPress sites. Once a vulnerability is public, automated bots scan the web looking for sites still running the vulnerable version.
Weak or reused passwords.
Simple admin passwords, or passwords reused from other accounts that have already been breached elsewhere, remain a common entry point.
Nulled or pirated plugins.
Free downloads of paid plugins from unofficial sources are one of the most direct ways malware gets installed, sometimes intentionally hidden inside the plugin itself.
No firewall or login protection.
Without basic protection, a site is left open to brute-force login attempts and automated attack traffic around the clock.
Shared hosting with poor isolation.
On some budget hosting setups, a vulnerability in one site on the same server can be used to compromise neighbouring sites.
What a hack actually looks like
It is rarely as obvious as a defaced homepage. More often it is quiet: hidden spam pages injected into the site, malicious redirects that only trigger for certain visitors, or the site being used to send spam email without any visible sign on the front end.
How to prevent it
Keep WordPress core, themes, and plugins updated. Only use plugins from official, trusted sources. Use strong, unique passwords and enable two-factor authentication on admin accounts. Install a reputable security plugin or firewall. Take regular backups stored somewhere separate from the site itself, so recovery is possible even in a worst-case scenario.
Why maintenance is the real answer
Every cause above is preventable with ongoing maintenance. A site that is updated, monitored, and backed up on a regular schedule is dramatically less likely to be hacked, and far faster to recover if something does slip through. Security is not a one-time setup task. It is an ongoing habit.