Contents6
One morning the site redirects to a pharmacy shop, Google shows a red warning, or the host suspends the account. The first question is “how?”, the second “why us?”. The answer to the second is almost always: not you in particular. Attacks on WordPress are automated; they target a vulnerable plugin, not a company. This article explains where they come from, what matters in the first hours, and the two ways out for good. WordPress remains a good tool for many teams; it simply needs upkeep that is better understood upfront.
In short
Vulnerabilities come from plugins and themes, almost never from the WordPress core.
The most targeted are exploited within hours, and nearly half have no fix when they are made public.
After a hack: isolate, change every access, restore a clean version, find the way in, notify if personal data is affected.
To stop it happening again: fewer plugins, followed-up updates, named accounts and tested backups, or a static site that no longer runs anything.
Where the attack comes from
WordPress runs 39.6% of all websites according to W3Techs. A hole in a widely used plugin therefore opens thousands of sites at once, and that is what makes the attack pay. Patchstack, a WordPress security vendor, publishes a yearly review of the vulnerabilities recorded:
new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024
were in plugins, the rest in themes; only 6 in the core, all low priority
had no fix from the developer when they were made public
the median time before mass exploitation of the most targeted vulnerabilities
Patchstack sells protection, which is a reason to read these figures with some distance; their overall meaning is not in dispute. The WordPress core is closely watched. The risk lies in the sum of plugins, written by dozens of authors with very different means.
Why updates are not enough
Updating remains essential, but three facts limit what updates protect:
- The fix does not always exist. Nearly one vulnerability in two is made public before the plugin’s developer has fixed it.
- Old vulnerabilities still work. Of the ten most attacked vulnerabilities in 2025, Patchstack counts only four published that year: attackers bet on sites that are never updated.
- Host protections stop little. In its 2025 tests, Patchstack found that common hosting defences blocked only 12% of WordPress-specific attacks.
That is why a WordPress site needs a maintenance budget every month, not just at build time: our article on what a business website costs counts it in the three-year bill.
The first hours after a hack
The goal is not to “clean up” as fast as possible, it is to restart from a clean version without leaving the door open.
- Isolate.
Put the site in maintenance mode or take it offline, so you do not serve malware to your visitors.
- Change every access.
Administrator accounts, hosting, database, FTP or SSH, API keys: from a clean machine.
- Restore a clean version.
A backup from before the intrusion is better than cleaning file by file.
- Find the way in.
The vulnerable plugin, the reused password, the forgotten account: otherwise the same attack starts again.
- Notify.
If personal data was affected, the GDPR expects the supervisory authority to be notified within 72 hours.
Manual cleaning often misleads: Patchstack notes that hacked files are increasingly legitimate WordPress, plugin or theme files into which a malicious snippet has been injected. Deleting them is not enough, they have to be replaced with clean versions. For notification, Article 33 of the GDPR requires the controller to notify the supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of a breach, unless it is unlikely to create a risk for the people concerned.
On Google’s side, the Security issues report in Search Console flags hacked content and malware Google has detected; once the site is fixed, that is where you request a review.
How to stop it, while keeping WordPress
The hardening guide published by WordPress comes down to a few rules that cost more in discipline than in money:
- Fewer plugins. The guide says it simply: a plugin you are not using gets deleted. Every plugin you keep is one more author you trust.
- Followed-up updates. Since WordPress 5.5, automatic updates for plugins and themes are switched on one by one; you still have to switch them on, and check they go through.
- Named accounts, with two-factor authentication. One account per person, removed when they leave; never a shared “admin”.
- Tested backups. A backup you have never restored is a hypothesis.
From the field
A backup is validated on its content
The rule is not specific to WordPress. A client learned it the hard way: on Palmora Property, a portal built with Astro and backed by a database, the restore tool returned an error on mere warnings. A restore is therefore validated on the number of tables and records recovered, in a throwaway environment. The off-server backup itself costs about 6 dollars a month there.
The same client also learned that access tokens written in plain text in a code repository are a way in like any other: they get revoked, replaced and erased from the history. Our article on server backups details what really breaks when it is time to restore.
Or stop running anything
The other path removes the cause instead of watching it. A static site is built at publication time, then served as files: no database to protect, no exposed admin panel, no plugin to update. Our guide to migrating to a static site with Astro explains how to move without losing your addresses, and sorting pages before a redesign where to start.
What made WordPress useful does not disappear for all that:
- The contact form plugs into a dedicated service, page by page: our article on forms and search on a static site shows how.
- The editor remains possible with a headless CMS such as Sanity, separate from the site visitors see.
- Hosting costs a few euros a month on a service that serves files (see our Cloudflare, Netlify or VPS comparison).
A static site is not invulnerable: what remains to protect are the accounts (host, domain name, code repository) and the publishing chain. This site is one: every change goes through a preview and automated checks before it is merged, and going live only happens on merge. The attack surface has nothing in common with a server running dozens of plugins.
The benefit does not stop at security: less code running also means a faster site on mobile, and a redesign is the right time to deal with the accessibility required since 2025. If you rewrite pages with AI along the way, whether to disclose it deserves a decision before launch.
Our migration to a static site carries over every address of your WordPress, puts the site live on hosting that costs a few euros a month and watches the switchover for fourteen days.
Frequently asked questions
How do I know if my WordPress site has been hacked?
Visible signs are redirects to other sites, unknown pages in Google, a browser warning or an alert from the host. The Security issues report in Search Console also flags hacked content and malware detected by Google. Finally, check the list of administrator accounts: an unknown account does not lie.
Should I clean the site or rebuild it?
Restoring a backup from before the intrusion is safer than cleaning, because malicious code increasingly hides in legitimate files. Without a clean backup, reinstall the core, plugins and theme from their official sources, then bring the content back. Either way, find the way in before putting the site back online.
Is managed hosting enough to protect WordPress?
It helps, without being enough. In the tests Patchstack published for 2025, common hosting defences blocked only a small share of WordPress-specific attacks, because many look like normal traffic. Updates, plugin pruning and access remain your job, or that of a maintenance provider.
Can a static site be hacked?
It has no database and no admin panel to attack, which removes most automated attacks against WordPress. The accounts remain: host, domain name, code repository. Protect them with two-factor authentication and named access, and send every change through a preview before publication.
Sources
- W3Techs, WordPress market share, October 2026 (new tab)w3techs.com
- EUR-Lex, General Data Protection Regulation (new tab)eur-lex.europa.eu
- Search Console Help, Security issues report (new tab)support.google.com
- WordPress, Hardening WordPress (new tab)developer.wordpress.org
- WordPress, plugin and theme auto-updates (new tab)wordpress.org
Jim · founder of Brain Plus AI
Also in websites, migration and astro
Understand8 min The topic guide
Static site with Astro: why migrate, without losing your SEO
A static site generated by Astro replaces an ageing WordPress or Drupal without changing a single address: pages in plain HTML served by a CDN, no plugin to patch, and a publishing chain with rollback. What it changes, how the migration goes, and when not to do it.
Practical guide7 min
How to add a form and search to a static site
A static site is not a frozen site: a form, a newsletter, internal search or an on-demand page can each be wired in separately. The options, and the rule that stops enquiries being lost.
Choose and price6 min
How much does a business website cost in 2026?
A business website is paid for twice: once to build it, then every year. What moves the first price, what inflates the second, and the questions that make two quotes comparable at last.