What actually gets WordPress sites hacked (it isn’t what you think)
It’s almost never a clever attacker targeting you. It’s a script finding a plugin you forgot you installed.
When a small business owner pictures their website being hacked, they tend to picture a person. Someone who chose them, studied the site, and found a way in. It feels personal, so it must be personal.
The reality is duller, and more useful to know. Almost every WordPress break-in starts with software doing the rounds, not a human with a grudge. Once you understand what that software is looking for, most of the defence turns out to be ordinary housekeeping.
You aren’t being targeted. You’re being scanned.
WordPress is used by around 40% of all websites, according to W3Techs. That makes it the obvious place to aim automated attacks: a single weakness in a popular plugin may exist on thousands of sites at once, and a script can check them all without caring whose they are.
The speed is the part most owners don’t expect. Patchstack’s State of WordPress Security in 2026 report found that roughly half of high-impact vulnerabilities are exploited within 24 hours, and that for the most heavily attacked ones the weighted median time to the first exploit was five hours. When a serious flaw in the Bricks builder was published in 2024, Patchstack’s previous report describes multiple IP addresses running scripted mass-exploitation campaigns within hours.
Wordfence makes the same point from the other direction. In its 2024 annual report, it explains that flaws which need no login at all are the ones most likely to be attacked in bulk, because anyone can run such an exploit and it is easy to automate.
A script doesn’t know your business exists. It only knows which plugin version you’re running.
The weak spot is almost never WordPress itself
People often assume “WordPress is insecure”. The numbers say something more specific. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem during 2025, a 42% rise on the year before. Of those, 91% were in plugins and 9% in themes. WordPress core, the part maintained by the WordPress project itself, had six, and Patchstack rated them all low priority.
So the risk isn’t really “WordPress”. It’s the collection of add-ons layered on top of it, each written by a different team, each updated (or not) on its own schedule. Every plugin you add is another door someone else is responsible for locking.
The plugin you forgot about
An update only helps if one exists. Patchstack found that 46% of vulnerabilities in 2025 had no patch available by the time they were publicly disclosed. In other words, for nearly half of the problems, the public learned about the hole before the developer had fixed it.
Some plugins never get fixed at all. In 2024, 1,614 plugins and themes were removed from the WordPress.org repository for unpatched security issues. Removal from the directory stops new people installing them. It does nothing for the sites that already have them.
This is how the “forgotten plugin” happens. Someone installed a slider for a promotion three years ago. The promotion ended, the slider was switched off, and nobody thought about it again. Switching a plugin off doesn’t remove its files from your server, which is why WordPress’s own hardening guide doesn’t say “deactivate plugins you don’t use”. It says: if you are not using a specific plugin, delete it.
Passwords still matter, just not in the way you think
Guessing passwords is still a huge background activity. Wordfence reports that it blocked over 55 billion password attacks in 2024, including brute force (trying password after password) and credential stuffing (trying passwords leaked from other websites). In fairness, the same report notes these attacks declined steadily through the year, while attempts to exploit vulnerable software went up.
Two details in that report are worth underlining. First, credential stuffing only works because people reuse passwords, so one leaked password from an unrelated shop can open your site. Second, Wordfence says its incident response team often finds that compromised hosting account credentials are a common way in, not the WordPress login at all. Your host, your domain registrar and your email deserve the same care as your WordPress admin.
A checklist you can do this afternoon
None of this needs a developer. It needs an hour and a bit of discipline:
- Update everything, then keep it updated. WordPress core, plugins and themes. The official hardening guide is blunt that older versions of WordPress are not maintained with security updates.
- Delete what you don’t use. Not deactivate: delete. Include old themes you’re not running. If you don’t recognise a plugin, find out what it does before you decide.
- Use a unique, strong password for every admin account, and for your hosting and email logins too. A password manager makes this painless.
- Turn on two-factor authentication. Both WordPress’s guide and Wordfence recommend it. Even if a password leaks, a code from your phone is still required.
- Review who has admin access. Wordfence recommends regularly auditing user accounts and following the principle of least privilege: give people the lowest role that lets them do their job. The designer who finished in 2023 doesn’t need to be an Administrator today.
- Keep backups you’ve actually tested. WordPress recommends regular backups including your database. A backup you’ve never restored is a hope, not a plan.
None of these steps make a site unbreakable. They take you out of the easy pile, which is where automated attacks do most of their damage.
Where Kepteo fits
Most owners know the checklist. The hard part is doing it every week. Kepteo’s plugin runs a daily security scan: it checks your WordPress core files against the official checksums, looks for signs of malware across wp-content (including PHP files hiding in your uploads folder), flags installed plugins with known vulnerabilities, and reviews your login set-up, security headers and admin users.
When something needs fixing, it offers reversible hardening options, covering login protection, XML-RPC, user enumeration, security headers and comments, and drafts the change for you to approve. Nothing is applied until you say so. The plugin never writes files to your server, and it can’t read wp-config.php or .env, where your site’s passwords live. It won’t make you unhackable; it makes sure the boring, important work actually happens.