How websites get hacked

Module 7: Security · Reading time: 8 minutes

Learning objective: After this lesson, you'll be able to explain realistically how WordPress websites usually get hacked, why small websites are targets too, and what attackers want with them.

Key concepts: vulnerability, flaw in a plugin or theme, automated scans, credential stuffing, brute force, nulled software, infected computer, consequences (spam, redirecting, phishing, malware), attack surface

"My website is too small to be interesting"

That's the most common misconception. Almost no WordPress hack targets one specific website. Attackers use programs that automatically scan thousands of websites per hour, looking for one thing: a known weakness. If the program finds it, it breaks in, whether the website belongs to a multinational or the local football club.

What they want isn't your website, but what your website can do:

• Spam and search engine abuse: thousands of hidden pages or links for medication, gambling or fake shops, riding on your domain's good name with Google.
• Redirecting: visitors (often only those from Google or on a phone) are sent to a fake website or scam page. You see nothing, because you arrive via a bookmark.
• Phishing: a fake login page for a bank or delivery service, hidden in your uploads folder, with your domain name in the link.
• Spreading malware to visitors.
• Sending mail: your server sends spam, and then your own mail stops being delivered.
• Computing power: your hosting package is used for attacks on other websites or for mining cryptocurrency.
• Data: at a webshop or membership site, your customers' data.

Entry point 1: a flaw in a plugin or theme

This is by far the most important one. According to the annual report from Patchstack, a company that tracks WordPress vulnerabilities, 7,966 new vulnerabilities were found in the WordPress ecosystem in 2024. 96% were in plugins, 4% in themes, and only seven in WordPress itself. Most flaws can't easily be exploited, but some can, and those are scanned for en masse within hours or days of disclosure.

The pattern is almost always the same:

1. A flaw is found in version 3.2 of a popular plugin.
2. The developer releases version 3.2.1 with a fix. The flaw becomes public.
3. Within a short time, programs scan the internet for websites running version 3.2 or older.
4. Anyone who hasn't updated yet gets broken into.

So the danger isn't a secret flaw that nobody knows about, but a known flaw for which an update already exists that hasn't been installed. That's why updates (lesson 7.2) are the single most important measure, and why you remove what you don't use (lesson 5.4): every plugin that's present, even deactivated, increases your attack surface.

A special case is abandoned plugins: the developer has stopped, and no more fixes are coming. And nulled software (lesson 5.3): a stolen copy of a paid plugin, often with a built-in backdoor.

Entry point 2: passwords

The second major entry point is logging in with a valid password:

• Credential stuffing: a data breach at another service has leaked millions of combinations of email address and password. Programs try these combinations on all sorts of websites, including WordPress login pages. If you use the same password as the one used for the breached service, they're in.
• Brute force: a program simply tries huge numbers of passwords, often with commonly used usernames like admin. With a long, unique password this has no chance of succeeding, but it does cost your server computing power.
• Phishing: a fake email saying "your WordPress needs to be updated, log in here" with a link to a fake login page.

Lesson 7.3 covers the defence: password manager, two-factor authentication and limiting login attempts.

Entry point 3: everything around WordPress

Not every hack starts in WordPress:

• An infected computer belonging to you or your web developer, with a program that steals passwords, for example the passwords saved in an FTP program.
• Plain FTP without encryption, on a public network.
• Another website in the same hosting package: a forgotten old test installation, an old Joomla install in a subfolder. All websites in one package usually share the same user on the server. If the old website gets hacked, the attacker can reach your WordPress too.
• A leaked database password, for example via a copy of wp-config.php in the web directory (lesson 1.3).
• Forms without validation that get abused to send spam.

With a good hosting provider, your package is isolated from other customers' packages on the same server (on DirectAdmin servers with CloudLinux, for example, using CageFS). What happens within your own package, however, remains your responsibility.

What you notice (and what you don't)

You usually don't notice a good hack at first. Attackers want to use your website for as long as possible. Signs to look for (lesson 7.5 covers this):

• Google reports "This site may be hacked", or you see strange pages from your domain in the search results (try searching for site:example.com);
• visitors report ending up somewhere else;
• there are administrators or files you don't recognise;
• your hosting provider or a malware scanner reports something;
• your mail suddenly stops arriving, or your package is full or slow.

Defence in layers

No single measure is watertight. Security is a stack of layers, so that a flaw in one layer doesn't immediately open everything up:

1. Updating (lesson 7.2): closes known flaws. By far the most important.
2. Few components (lessons 5.3 and 5.4): less to update, fewer flaws.
3. Securing logins (lesson 7.3): long unique passwords, two-factor authentication, least privilege (lesson 3.3).
4. Hardening (lesson 7.4): permissions, settings and headers that limit damage.
5. Backups (lesson 8.1): if things still go wrong, you can go back.
6. Knowing what to do when it goes wrong (lesson 7.5).

Summary

• Almost all hacks are automated and untargeted; small websites are just as much a target.
• Attackers want what your website can do: spam, redirecting, phishing, mail, computing power, data.
• The biggest entry point is a known flaw in a plugin or theme for which an update already existed (in 2024, 96% of new vulnerabilities were in plugins).
• The second entry point is passwords: reused, guessed or phished.
• An infected computer, plain FTP or a forgotten old website in the same package can also be the entry point. Defend in layers.

Quiz

Exercise

Exercise D7.1: Your own risk list. Make a list of everything in your hosting package that could be an entry point: every WordPress installation (including test and old websites), every plugin and theme (including inactive ones), every account with administrator rights (WordPress, FTP, the hosting control panel), and the computers used to log in. Note for each item: when it was last updated, whether it's still needed (yes/no), and who's responsible. Tick off the three things you'll clean up or update this week and write down why you chose exactly those.

Further reading

These articles describe the steps in WebOké's control panels; in other panels the process is similar.

• Help! My site has been hacked. How can I fix or prevent this?
• DirectAdmin guide 18.2: My website has been hacked: step-by-step plan
• State of WordPress Security in 2025 (Patchstack, English): https://patchstack.com/whitepaper/state-of-wordpress-security-in-2025/
• WordPress security (developer.wordpress.org, English): https://developer.wordpress.org/advanced-administration/security/hardening/