Why WordPress sites keep getting hacked - and what it actually costs

WordPress runs a large share of the world's websites, and that success is exactly why it is attacked so relentlessly. If you own a WordPress site and worry about security, you are right to - but the reason is not that WordPress is badly built. The real story is more specific, and understanding it is the difference between endless low-level anxiety and a clear-eyed decision about how to run your website safely. This guide explains, in plain language, why WordPress sites keep getting hacked, and what a breach genuinely costs a small business once every consequence is added up.

The figures in this article follow published security research, notably Patchstack's annual State of WordPress Security reporting and secondary coverage of it. Exact numbers move year to year; the pattern they describe is stable. Treat the specific percentages as indicative rather than precise.

It is almost never the core

Start with the single most important fact, because it reframes everything. The WordPress core - the software the WordPress project itself maintains - is not where the danger lives. Across a recent year, security researchers disclosed on the order of eleven thousand WordPress vulnerabilities, and the overwhelming majority - around nine in ten - were found in plugins and themes, not in WordPress itself. The core had only a handful of issues all year. In other words, WordPress as shipped is reasonably secure. The risk is almost entirely in the dozens of third-party add-ons that a typical site bolts on to do the things the core does not.

The plugin economics problem

To understand why plugins are the weak point, follow the money. The vast majority of WordPress plugins are free, maintained by individuals or tiny teams in their spare time, and monetised lightly if at all. That is a wonderful thing for the ecosystem and a difficult thing for security, because security is unglamorous, unpaid work. When a vulnerability is found in a free plugin, there is often no commercial incentive and no spare capacity to fix it quickly. By some recent measures, roughly half of plugin developers did not have a patch ready before the flaw was made public, and a large share of disclosed vulnerabilities had no fix available at the moment they became known. Every one of those is an open door with a published address.

Attackers move in hours, not days

The window between a vulnerability becoming public and being exploited is far shorter than most owners imagine. The median time from disclosure to the first real-world exploitation attempt has been measured in a handful of hours. This is possible because attackers do not hunt sites by hand - automated scanners crawl the web continuously, fingerprint which software and plugins a site runs, and fire known exploits at scale the moment one is published. A large proportion of these vulnerabilities can be exploited without any login at all, and hundreds of new plugin vulnerabilities are disclosed every month. For a site running even a modest stack of plugins, the odds that one of them is exposed at any given time are not small.

The supply-chain shift

The threat is also changing shape in a way that makes it harder to defend against. The newer pattern is the supply-chain attack: instead of hunting for holes in your site, attackers target the plugins themselves. They buy or hijack a legitimate, popular, well-reviewed plugin and push a malicious update through the normal update channel into every site that trusts it. From the owner's side this is almost impossible to catch - you did everything right, chose a reputable plugin and kept it updated, and the update itself was the attack. It is a sobering illustration of the core problem: every plugin is a piece of someone else's code running inside your website, and you are trusting all of them at once.

Why "just keep everything updated" is harder than it sounds

The standard advice is "keep everything updated," and it is correct - most breaches exploit a vulnerability for which a fix already existed. But following it properly is a real discipline, not a checkbox. Updates sometimes break things: a plugin update can clash with another plugin or with your theme and take the site down, so a careful owner tests updates on a staging copy first, which takes time and skill. A busy owner postpones them instead, and every postponed update is a window of exposure. The gap between "an update is available" and "the update is safely applied" is exactly where a great many sites get caught.

The abandoned-plugin trap

Plugins do not last forever. Developers move on, lose interest, or stop maintaining a plugin that no longer pays. A plugin that was safe and well-maintained when you installed it can quietly become abandoned, and an abandoned plugin never gets the fix when a vulnerability is found in it. Because it still works, you have no reason to notice - until it is exploited. Auditing your plugins for ones that have gone quiet is important, ongoing work that most owners never do because nothing appears to be wrong.

Nulled and pirated add-ons

A particularly common infection route deserves a direct warning: "nulled" plugins and themes - pirated copies of premium products offered free on unofficial sites. These are a classic delivery mechanism for malware. The cracked version works, which is the point, but it frequently ships with a backdoor baked in, handing an attacker access from the moment it is installed. Saving a licence fee this way is one of the most expensive mistakes a site owner can make. Only ever install plugins and themes from the official directory or the developer directly.

Weak credentials and no hardening

Not every compromise comes through a plugin. Plenty come through the front door: an admin account with a guessable password, no two-factor authentication, a login page left open to unlimited attempts, or an old administrator account nobody remembered to remove. Automated bots try common username and password combinations against WordPress login pages constantly. A site with weak credentials and no login hardening is a soft target regardless of how good its plugins are - and hardening this properly is, again, a job someone has to do and keep doing.

Popularity is the attack surface

WordPress powers a very large share of all websites, and that scale is a magnet. Automated attackers get the best return by targeting the most common software, so they build their tools around WordPress first: scanners that recognise it on sight, exploit kits for its popular plugins, bots that hammer its standard login page. The same ubiquity that makes WordPress easy to hire help for, and easy to find a plugin for, makes it the default target for indiscriminate, industrial-scale attacks. None of that is a flaw in WordPress; it is simply what being the biggest platform costs.

Themes carry risk too

Plugins get most of the blame, but themes are code as well, and they can carry the same kinds of vulnerabilities - especially large multi-purpose premium themes that bundle their own page builders, sliders and helper libraries. A vulnerability in a bundled library inside a theme is just as exploitable as one in a standalone plugin, and because it is buried in the theme, it is easy to forget it needs updating. Treat your theme with the same caution as your plugins: keep it current, buy from reputable sources, and be wary of themes that try to be everything at once.

The server underneath matters

A WordPress site does not run in isolation - it sits on a web server running a particular version of PHP and other software, and those have security lives of their own. An out-of-date PHP version or a poorly configured server can expose a site regardless of how tidy its plugins are. On cheap, unmanaged hosting this is your responsibility, and it is one more thing that quietly needs attention. Managed hosting takes it off your plate, at a price; a managed platform takes it off your plate as part of the service.

Why sites get reinfected: backdoors

One of the most demoralising experiences is cleaning a hacked site only to watch it get compromised again days later. The usual cause is a backdoor - a hidden piece of code the attacker left behind precisely so they can return after you think you have cleaned up. Backdoors hide in unexpected places: an innocuous-looking file in the uploads folder, an extra line in a legitimate file, a rogue administrator account. This is why superficial cleanups fail and why thorough, sometimes professional, remediation matters - if a single backdoor survives, the whole clean-up was for nothing.

"My site is too small to be a target" is a myth

Many owners assume attackers only care about big, valuable sites. The opposite is true for the automated attacks that cause most compromises: they do not know or care who you are. A bot scanning for a specific vulnerable plugin will exploit a village hall site as readily as a national brand, because the goal is often not your data at all but your server - to send spam, host scam pages, mine cryptocurrency, or attack other sites from yours. Being small is not protection; it usually just means less defence and a slower discovery.

What living with the risk feels like

Beyond the statistics, there is the day-to-day experience of owning a plugin-heavy WordPress site: the steady trickle of update notices, the small worry each time you apply one that it might break something, the news of yet another plugin vulnerability, the nagging uncertainty about whether your backups actually work. None of it is catastrophic on its own, but together it is a low, constant background hum of responsibility. For many owners, the strongest argument for change is not any single statistic but simply wanting that hum to stop.

Layered defence, not a silver bullet

There is no single product that makes a WordPress site safe. Real security comes from layers working together: minimal plugins from trusted sources, prompt updates, strong credentials with two-factor authentication, a web application firewall, hardened server settings, off-site backups, and monitoring. Miss one layer and the others may not save you. This is why installing a single security plugin is not an answer on its own - it is one layer among many, and it cannot patch a hole in a different plugin that has no fix. Good security is a system you maintain, not a switch you flip.

The work never actually ends

The hardest thing about WordPress security is not any single task but the fact that it never finishes. New vulnerabilities are disclosed every week, plugins need updating on their own schedules, backups need testing, and the whole stack needs watching. A site that is perfectly secure today can be exposed next week by a newly found flaw in a plugin you have run happily for years. Security on WordPress is not a project you complete; it is a standing responsibility you carry for as long as you own the site.

Security is a running cost, however you pay it

Because the work never ends, security is always a cost - the only question is the currency. You pay it in your own time if you do it yourself, in fees if you pay a host or agency to do it, or in damage if you skip it and get unlucky. There is no version where a plugin-heavy WordPress site is both secure and free of ongoing effort. Seeing that clearly is what leads many owners to ask whether they want to keep paying that particular bill at all.

The core lesson

If there is one thing to take from all of this, it is that WordPress security is not so much hard as endless: a manageable set of tasks that simply never stop. That is perfectly fine if you have the time and the inclination for it. It is a genuine, open-ended burden if you do not. Recognising honestly which of those describes you is the first step toward deciding how you actually want to run your website - and whether carrying this particular responsibility is a good use of your time.

What a hack actually costs

It is tempting to treat "getting hacked" as an abstract risk, so it helps to put a number on it. Once everything is added up, the average cost to a small business of recovering from a serious website compromise is commonly put in the region of fourteen to fifteen thousand dollars. That figure is not one line item; it is the sum of several:

• Malware removal. Professional cleanup of an infected site is skilled, time-consuming work, and reinfection is common if the entry point is not fully closed.
• Developer time. Diagnosing how it happened, restoring the site, and rebuilding anything that cannot be recovered.
• Downtime and lost trade. Every hour the site is down, defaced or flagged is business that does not happen and customers who go elsewhere.
• Search-ranking damage. A hacked site can be removed from search results or labelled as unsafe, and recovering that visibility takes weeks.
• Reputation. Customers who saw a warning on your site, or received spam from your domain, do not forget it quickly.

Set against a modest ongoing spend on doing security properly, or against a platform where security is simply not your problem, the arithmetic of prevention is compelling.

The hidden search cost

The ranking damage deserves its own mention because it is the consequence owners least expect. When a search engine detects that a site is compromised - serving malware, redirecting to spam, hosting injected pages - it protects its users by flagging the site with a warning, dropping its rankings, or removing it from results entirely. A business can lose in a day the search visibility it spent years building, and getting reinstated requires cleaning the site, proving it is clean, and requesting review. The security incident and the SEO incident are the same event, and the second half of it lingers long after the malware is gone.

Three ways out

If all of this describes a burden you no longer want, there are broadly three honest paths, and the right one depends on your site and your appetite for the work:

• Harden and maintain it yourself. Keep plugins to a ruthless minimum, update on a disciplined schedule with a staging site, use strong credentials and two-factor authentication, run a web application firewall, take and test backups, and audit regularly. It works - but it is real, ongoing work.
• Pay for managed WordPress hosting. A good managed host handles updates, backups, firewalling and monitoring for you. It reduces the burden considerably, at a higher monthly cost, though you still own the plugin choices and their risks.
• Move to a platform where security is not your job. On a managed platform like the CMS Pros Platform there are no plugins to secure, because the features you need are built in and maintained by one team. Security stops being a task you have to keep on top of and becomes something handled for you by default.

How to reduce your risk today

If you are staying on WordPress for now, a handful of habits cut your risk sharply. Keep the number of plugins as low as you can and remove any you do not actively need - every plugin removed is an attack surface removed. Install only from the official directory or the developer directly, never from a "nulled" source. Update core, themes and plugins promptly, ideally after testing on a copy. Delete plugins and themes that are deactivated rather than leaving them installed. Use strong, unique passwords and turn on two-factor authentication for every administrator. Take automatic backups and confirm you can actually restore from them. Consider a reputable web application firewall. None of this is exotic; the difficulty is simply doing all of it, consistently, forever.

Already been hacked?

If you are reading this because your site is compromised right now, work through our step-by-step guide, WordPress site hacked? Recovery steps, which covers containing the damage, cleaning the site, rotating credentials and getting back into search engines' good books. And once the fire is out, this article's question - why it happened - is the one worth sitting with, because the honest answer often points toward a calmer way of running a website altogether. It is also worth reading the real annual cost of running a WordPress website, which puts the security burden in the context of the total bill.

Frequently asked questions

Is WordPress itself insecure? No. The WordPress core is actively maintained and has very few vulnerabilities. The risk lives overwhelmingly in third-party plugins and themes, and in whether everything is kept patched.

Will a security plugin keep me safe? A good one helps, but it is not a guarantee - it is one more plugin to maintain, and it cannot fix a vulnerability in another plugin that has no patch. Layered habits matter more than any single tool.

How quickly do sites get attacked? Automated scanners can begin trying a newly-published exploit within hours. Attacks are opportunistic and continuous, not targeted at you personally.

Does a small business site really get targeted? Yes - most attacks are automated and indiscriminate. Being small is no protection; it often just means less defence.

What is the single most effective thing I can do? Reduce your plugin count and keep what remains rigorously updated - or move to a platform where that whole category of risk is handled for you.

A calmer alternative to running WordPress yourself

If the upkeep, the security worry or the cost of running WordPress has worn thin, a managed platform is worth a look. On the CMS Pros Platform, security, updates and backups are handled for you, your content and rankings come across intact, and the site stays genuinely yours to export at any time. See how a move works on our WordPress migration guide, or request a free migration audit and we will tell you honestly whether moving makes sense for your site.