WordPress does not have a security problem; unmaintained WordPress does. In the overwhelming majority of compromised sites, the door was opened not by a flaw in the software itself but by a plugin left unpatched for months or a guessable password.
Short answer: how do WordPress sites get compromised?
Most attacks arrive through four routes: an unpatched plugin or theme, a weak administrator password, an unprotected login page, and incorrect file permissions on the server. Target selection is usually impersonal — automated scanners look for sites with known vulnerabilities and do not care about size. Protection therefore rests not on sophisticated tools but on update discipline and hardening the entry points.
The four openings attackers use
1. Unpatched plugins and themes
Once a vulnerability is published, tools exploiting it circulate quickly. A plugin left unpatched for months does not even require an attacker to choose a target; the scanner finds exposed sites by itself. The riskiest group is abandoned plugins — even when a flaw is found, no patch ever arrives.
2. Weak or reused passwords
An exposed login page is under constant attempts. A simple password falls within hours. More insidious is a password leaked elsewhere and reused here: the attacker breaks nothing and simply logs in.
3. Unprotected login and XML-RPC
A login page without attempt limits grants unlimited guesses. An XML-RPC interface left open while unused can also be abused for bulk attempts.
4. Incorrect permissions and the uploads folder
If PHP can execute inside the uploads folder, a file-upload flaw turns directly into code execution on the server. This is the single most damaging configuration mistake.
The ten-point hardening list
| # | Measure | What it prevents | Difficulty |
|---|---|---|---|
| 1 | Enable automatic security updates | Exploitation of known flaws | Easy |
| 2 | Delete unused plugins/themes (deactivating is not enough) | Dormant but reachable code | Easy |
| 3 | Two-factor authentication on admin accounts | Login with stolen passwords | Easy |
| 4 | Do not use the username "admin" | Half of brute-force attempts | Easy |
| 5 | Limit login attempts | Unlimited password guessing | Easy |
| 6 | Disable PHP execution in the uploads folder | File upload becoming code execution | Medium |
| 7 | Disable the file editor (DISALLOW_FILE_EDIT) | An intruder writing code from the panel | Easy |
| 8 | Disable XML-RPC if unused | Bulk credential attempts | Medium |
| 9 | Minimise administrators, assign correct roles | Unnecessary privilege spread | Easy |
| 10 | A separated backup the server cannot reach | An attack becoming permanent damage | Medium |
The first five can be applied in an afternoon without technical expertise and close a significant share of the attack surface. The last one does not prevent an attack — it changes its outcome.
Cleaning a hacked site: the correct order
- Back up first — including the compromised state. It is your return point if cleaning goes wrong, and it is needed for investigation.
- Change every password: admin accounts, database, FTP/SSH and the hosting panel. Changing only the WordPress password is not enough.
- Locate the malicious code. Scanning by modification date, comparing core files against originals, and searching for PHP files inside
wp-content/uploadsare the first three steps. - Hunt for backdoors. Attackers usually leave more than one entry point; deleting only what is visible leaves the site open to rapid recompromise.
- Check for unauthorised users. Administrator accounts added afterwards are the most commonly missed item.
- Restoring from a clean backup is often faster and safer than cleaning an extensive infection.
- Close the opening. Cleaning without establishing how entry occurred simply repeats the scenario.
- If a search engine warning exists, submit a review request after cleaning.
The monthly routine: 30 minutes
- Apply core, plugin and theme updates (on staging first).
- Review the user list; remove departed people and unnecessary administrator rights.
- Verify that backups are being taken and can be restored.
- Identify abandoned plugins and replace them.
- Check SSL and domain expiry dates.
Netişlem expert view: sites that get hacked again after cleaning
A considerable share of the cases we receive begin with "we already cleaned it, and it happened again". The reason is almost always the same: the visible malware was removed but the entry route was never closed. The site is cleaned and re-entered days later through the same opening.
The second frequent case is missed backdoors. Attackers rarely leave a single file; they place several entry points across folders, sometimes under legitimate-looking names. Deleting only the first one found produces misleading confidence.
Third is cleaning without a backup. When a file is deleted by mistake during the work, there is no return point and a minor incident becomes data loss.
So we always recommend this order: backup first, then passwords, then identify the entry route, and clean last. Work that begins with cleaning usually has to be done twice.
Frequently asked questions
Is installing a security plugin enough?
It helps but is not sufficient alone. Security plugins mostly provide login limiting, scanning and alerts; they do not patch a vulnerability in an outdated plugin. The foundation is update discipline; a plugin is a layer added on top.
My site is small — why would I be targeted?
Most attacks are not aimed at hand-picked targets but at exposed sites found by automated scanning. Compromised small sites are typically used for sending spam, hosting fraudulent pages or as a stepping stone — the value of your content is not the deciding factor.
Is deactivating an unused plugin enough?
No. A deactivated plugin's files remain on the server, and some flaws can be exploited even when it is inactive. Unused plugins and themes should be deleted.
Can automatic updates break my site?
Incompatibilities are possible, though uncommon. The ideal setup tests updates on staging first. But even without staging, postponing security updates creates a larger risk than the chance of incompatibility.
How do I know if I have been hacked?
Typical signs: pages you never created appearing in search results, visitors being redirected elsewhere, unfamiliar administrator accounts, sudden spam being sent from your server, and browser security warnings. Some infections are visible only in search results — which is why regular checks matter.
Conclusion
WordPress security is not a purchasing decision but a maintenance habit. Half an hour of regular monthly maintenance closes most of the attack surface, and a separated backup softens the consequence of whatever remains.
If you would like us to scan your current state and set up a maintenance routine, get in touch. You can also review our WordPress hosting, managed WordPress and secure hosting solutions.