The short answer: why do WordPress sites get hacked?
WordPress sites get hacked when an attacker finds a weakness they can exploit, and in many cases that weakness is not WordPress core itself. In the compromised sites we have been called in to recover, the more common problems have been outdated plugins, exposed or reused credentials, unnecessary administrator accounts, poor security configuration and websites that have gone too long without maintenance.
That does not mean WordPress core can never have a security issue. It can, which is why WordPress publishes security releases and recommends keeping the platform, themes and plugins up to date. The important point is that WordPress security is not one setting or one plugin. It is the condition of the whole website and the way access to it is managed.
Why is WordPress targeted so often?
WordPress is used on a very large share of the web. According to W3Techs, it powered 41.2% of all websites as of August 2026, which makes it an obvious target for automated scanning.
For many SME websites, an attack is not personal. Nobody has necessarily chosen your company and spent days trying to break in. Automated tools can check large numbers of websites for a known weakness, an exposed login or an outdated component. If your site has the weakness they are looking for, it can be compromised along with thousands of others.
That distinction matters because prevention becomes much more practical. You do not need to make a website impossible to attack. You need to remove the obvious openings, keep the software current, control access and know quickly when something changes.
We still use WordPress extensively for business and corporate websites because it is flexible, well supported and gives clients control over their content. You can read more about how we approach WordPress and CMS development.
What actually causes WordPress websites to get hacked?
1. Outdated plugins and themes
This is one of the first things we check in a compromised site. Plugins and themes add code to WordPress, and like any software, that code can contain vulnerabilities. Responsible developers release fixes, but the fix only helps once the website has actually been updated.
A useful current example is Smart Slider 3. Its official WordPress changelog recorded vulnerability or security improvements several times during 2026, including releases in March, May and July. That does not mean Smart Slider 3 is a bad plugin. It shows how normal software maintenance works: an issue is identified, the developer publishes a fix, and site owners need to install it.
You can see the Smart Slider 3 release history on WordPress.org.
2. Weak, reused or exposed passwords
A strong WordPress password does not help if the same password has already been exposed somewhere else. Reused credentials can give an attacker access without having to exploit the website at all.
We have also dealt with a client who received a credential exposure alert through a law-enforcement operation. The response was not simply to change one WordPress password. We reviewed the wider access around the site as well, because hosting, administrator and other connected accounts all form part of the security picture.
Use a unique password for every administrator account and enable two-factor authentication wherever possible.
3. Nulled or unofficial themes and plugins
A paid plugin downloaded free from an unofficial source can be modified before you ever install it. Even if it appears to work normally, you have no reliable way to know what has been added to the code.
WordPress itself recommends using trusted sources for themes and plugins. If a premium tool is required, buy it from the developer or an authorised source rather than downloading a copied version from a resale or file-sharing site.
4. Too many administrator accounts
Administrator access should be limited to people who genuinely need it. Old staff accounts, former developers and temporary contractor logins are easy to forget, especially on a site that has been through several agencies or internal teams.
Every unused administrator account is another set of credentials that can potentially be compromised.
5. Poor login and access protection
A firewall, rate limiting and two-factor authentication will not fix an outdated plugin, but they add useful layers of protection against automated login attempts and malicious traffic.
Security works best in layers. Updates, access controls, firewall protection, backups and monitoring each solve a different part of the problem.
6. Websites that nobody is maintaining
This is the pattern behind many of the cases we see. The website launches, works well, and then nobody is clearly responsible for it. Months pass. Plugins accumulate updates, old accounts remain active and backups are assumed to be working because nobody has needed one yet.
Almost every compromised site we have been called in to recover had no active maintenance in place at the time. That does not prove maintenance can prevent every attack, but it does remove many of the conditions we repeatedly find after a compromise.
What does a hacked WordPress site look like?
Not every hacked website suddenly displays a warning message or a defaced homepage. In fact, some of the more serious compromises are easy to miss because the public-facing website can continue to look normal.
Common warning signs include:
- Pages appearing in Google that you did not create
- Spam content about gambling, pharmaceuticals, counterfeit products or unrelated topics
- Visitors being redirected to another website
- Redirects that only happen on mobile or when someone arrives through a search engine
- Links or text hidden off-screen so visitors cannot see them but search crawlers can
- Administrator accounts you do not recognise
- Plugins you did not install
- Your hosting company warning you about malware or outbound spam
- An unexplained fall in organic search traffic
A real WordPress recovery example
In 2026, we were called in to recover a compromised website for a Kuala Lumpur SME. The site still looked like the client’s website, but when we inspected the WordPress installation we found 10 unauthorised administrator accounts and four malicious plugins.
That is why checking whether the homepage still loads is not enough. A compromised website can continue functioning while an attacker retains access in the background. In this case, the recovery work ultimately cost more than the original website build.
We have written about this kind of recovery in more detail in what went wrong on a hacked WordPress site we recovered.
Can a hacked website affect SEO?
Yes. A compromised site can create problems well beyond the website itself.
Attackers may inject spam pages, hidden links or redirects specifically to take advantage of the authority your domain has already built up. Google can identify hacked content and security problems through Search Console, and affected pages may appear with warnings or be treated differently in search while the issue is unresolved.
If you suspect a compromise, check the Security Issues report in Google Search Console as part of the investigation.
The technical clean-up may take less time than the search recovery. Google still needs to recrawl the cleaned site and verify that the hacked content, redirects and security problems are gone.
How do you prevent a WordPress website from being hacked?
There is no single switch that makes a WordPress website secure. The most effective approach is a set of fairly ordinary habits carried out consistently.
- Keep WordPress, themes and plugins up to date. Security fixes are only useful if they are installed.
- Delete plugins and themes you no longer use. Do not keep unnecessary code on the server simply because it is deactivated.
- Use unique passwords and two-factor authentication. Apply this to administrator, hosting and other important accounts connected to the website.
- Limit administrator access. Give users the lowest level of access they genuinely need.
- Review user accounts regularly. Remove former staff, suppliers and contractors as soon as they no longer need access.
- Use firewall and login protection. These add another layer against automated attacks and suspicious traffic.
- Install software only from trusted sources. Use WordPress.org or the original developer.
- Keep backups away from the live website. A backup stored only on the same compromised server may not give you the clean recovery point you expect.
- Test important updates before pushing them live. A staging environment lets you check compatibility without using the production website as the test environment.
- Monitor the site after updates. A successful update message does not confirm that every form, integration and customer journey still works.
For more on the backup side of this, see our guide to website backups and disaster recovery.
How often should WordPress security and maintenance be checked?
There is no universal schedule for every website. A frequently updated e-commerce site needs a different backup and monitoring rhythm from a small corporate website that changes once a month. As a practical baseline, however:
| Task | Practical baseline | Why it matters |
|---|---|---|
| Plugin and theme updates | Check weekly, with security fixes handled sooner where appropriate | Closes known vulnerabilities and keeps components compatible |
| WordPress core updates | Apply security releases promptly after the necessary checks | Keeps the core platform on supported security fixes |
| Backups | Daily for active business sites, adjusted to how often data changes | Gives you a recent recovery point if something goes wrong |
| Backup restore test | Regularly, not only after an emergency | Confirms that the backup can actually be restored |
| User account audit | Quarterly and whenever staff or suppliers change | Removes unnecessary access before it becomes a risk |
If your team does not have someone responsible for these checks, that is where a website maintenance plan becomes useful. The important part is not simply having a maintenance contract. It is knowing exactly what is being checked, how often and what happens when something is found.
What should you do if your WordPress site is already hacked?
Do not start randomly deleting suspicious files from the live site. You can remove the visible symptom while leaving the original entry point or another backdoor in place.
A proper recovery usually involves:
- Isolating the website. Limit further damage while the problem is investigated.
- Preserving a copy of the compromised site and available logs. These can help identify how access was gained.
- Rotating important credentials from a clean device. This includes administrator and hosting access, and other credentials that may have been exposed.
- Auditing administrators, plugins, themes and files. Look for anything that does not belong.
- Identifying and closing the entry point. Cleaning malware without fixing the cause leaves the site open to reinfection.
- Restoring from a known-clean backup where appropriate. The backup must pre-date the compromise and should be checked before it is trusted.
- Updating and hardening the rebuilt site. Bring WordPress and its components up to date and review security settings before returning it to production.
- Checking Google Search Console and search results. Remove injected pages and request a review if Google has reported a security issue.
One of the hardest parts of recovery is knowing whether you have actually removed the attacker, not simply the malware you happened to find first.
Why ongoing maintenance matters more than a one-off security setup
Security hardening at launch is important, but it is a starting point. A website changes after launch. WordPress changes, plugins change, people join and leave teams, passwords get exposed and new vulnerabilities are discovered.
This is why we treat website security as an ongoing responsibility rather than a launch checklist. Regular updates, backups, access reviews and monitoring reduce the amount of time a known problem can sit unnoticed.
Our Website Care & Security service is designed for businesses that want those checks managed rather than relying on someone internally remembering to do them.
