Most WordPress sites are hacked through a plugin or theme with a known security hole that hasn't been updated, or through a password used somewhere else. Patchstack recorded 11,334 new vulnerabilities in the WordPress world in 2025, 91% of them in plugins. Bots scan for them automatically, so being small doesn't protect you.
The usual ways in
- Outdated plugins and themes, especially ones no longer maintained
- Nulled (pirated) premium plugins, which often come with malware built in
- Reused or weak admin passwords with no two-factor login
- Old PHP versions and shared hosting where one infected site affects others
- Former developers or staff whose accounts were never removed
How to stop it
- Update WordPress, plugins and themes regularly, tested on a copy first.
- Delete plugins and themes you don't use.
- Use unique passwords and two-factor login for every admin.
- Add a web application firewall.
- Keep daily off-site backups you've tested restoring.
- Remove old users and limit who is an administrator.
If it's already happened, start with hacked website repair. If you'd rather it was looked after, see ongoing support.
