“Why my site? I’m not even that interesting, am I?” That’s usually the first question I get after a hack. WordPress websites are primarily hacked through outdated plugins and themes, weak or reused passwords, “nulled” themes, insecure hosting, missing two-factor authentication, outdated PHP versions, and old installations left on the same account. Below, you’ll find an explanation of each cause—how it works, how to tell if it was your site that was compromised, and what to do about it.
How a WordPress Hack Usually Works
A WordPress hack almost always starts with an automated scan, not with someone who has specifically targeted your business. Bots scour the entire internet looking for plugins with known vulnerabilities and login pages that accept weak passwords. If they find one, the attacker plants malware or a backdoor, and from that moment on, your site is used for spam, redirects, or data theft. Think of it like a burglar who doesn’t pick a single house but walks down the entire street looking for an open window. Your site isn’t the target—the open window is the target.
That also means that WordPress itself isn’t the problem. The core receives security updates quickly, and the risk almost always lies in what surrounds it. Most of the hacks I see could have been prevented with an update and two-factor authentication. That might sound harsh, but it mainly means that you can plug the biggest security holes yourself.
Causes 1 and 2: Outdated plugins and weak passwords
Outdated plugins and themes are the most common entry point for a WordPress hack, because an update usually patches a disclosed vulnerability, and bots start actively searching for that vulnerability as soon as it’s made public. There’s often very little time between when a vulnerability is disclosed and the first attacks occur, so don’t wait weeks to install security updates. The same applies to the WordPress core—just leave the automatic security updates for it turned on. Plugins that no longer receive any updates at all—because the developer has stopped maintaining them—are particularly risky. Occasionally, the opposite happens, and a backdoor is actually introduced with an update, either because a plugin has been taken over or the developer themselves has been hacked. If you want to stay on top of this, read how to Clean up outdated plugins addresses and how you Monitoring vulnerabilities in plugins can. You can also outsource the updates through WordPress maintenance.
The second cause lies in passwords, and there are two different factors at play here. A weak password can be guessed using a brute-force attack—a bot that tries thousands of combinations in succession. A reused password doesn’t even need to be guessed, because it comes from a data breach at another service and is simply tried on your site (credential stuffing). Passwords can also be compromised through phishing or malware on your own laptop, such as Phishing emails asking for your cPanel credentials. You can recognize this by a large number of failed login attempts or by administrators with technical-sounding names that you don't recognize. For example, on June 18, 2026, the NCSC issued a warning about fake accounts that start with "wp-maintenance-" or "wp-backup-." Therefore, use a password manager and check your email address on haveibeenpwned.com.
Causes 3 through 5: nulled themes, insecure hosting, and no 2FA
Nulled themes and plugins are cracked versions of paid software, and they often already contain a backdoor before you even install them. Furthermore, they never receive updates. If you’ve ever downloaded a premium theme for free from an unknown site, delete it and buy the official version. More on this in Why You Should Never Use Nulled Themes.
Insecure hosting is the fourth cause. Examples include servers without isolation between accounts—which allows an infection to spread to another customer—the absence of a server firewall, or outdated server software. If you see multiple sites on the same server getting infected at the same time, that’s a strong indication. I want to be honest here. Good hosting isolates accounts from one another, but it doesn’t always prevent a vulnerability in your own plugin. That’s why you should choose a hosting provider with a server-level firewall and standard malware scans, such as Managed WordPress Hosting, and keep your plugins up to date yourself.
The fifth cause is the lack of two-factor authentication (2FA). Without that extra code, a single leaked password is enough to gain access—and that goes for your hosting control panel and the administrator’s email address as well. You can read about how to set this up in Securing the WordPress Login.
Causes 6 and 7: An outdated PHP version and old installations
An outdated PHP version (end of life) no longer receives security updates, which makes your server vulnerable regardless of what happens in WordPress itself. There’s another issue as well: An outdated PHP version often keeps old plugins in use because new versions of those plugins no longer run on it. You can view your current version in WordPress under Gereedschap > Sitediagnose, and on php.net you can check whether that version is still supported. On our shared hosting, you can choose a version between 7.4 and 8.5 via cPanel > Select PHP Version. Instructions on how to switch safely can be found in Update PHP Version.
In my experience, the seventh cause is the one most often overlooked. It involves old installations on the same hosting account, such as a test site, an old WordPress installation in a subfolder, or a forgotten subdomain. No one is actively maintaining them anymore, but they do share the account and files with your live site. If one of these old installations gets infected, the malware spreads to your live site. A common pattern is when your live site is clean, yet the malware keeps coming back. Make a backup, review all installations on your account, and remove anything you no longer use.
Here's how to find out after the fact which vulnerability was exploited to hack your site
If you want to know which of these seven causes was responsible after a hack, start by examining the clues the attacker left behind. This is the order I follow myself.
- Check the access logs from around the time of the infection. On our shared hosting, these are located in cPanel under Raw Access and every night as a .gz file in the folder
/logs. - Sort the files by "Last Modified" and look for changes you didn't make yourself.
- Compare your list of plugins with the known vulnerabilities in WPScan or Patchstack.
- Check the user list for unknown administrators and their last login.
If your site is currently infected, start by WordPress website hacked, now what? and then read how to Removing Malware from WordPress addresses.
At Surver, we already mitigate some of these threats at the server level. On all shared hosting plans, a ModSecurity firewall and Bot Blocker block many attacks, and Imunify scans the entire server every time a file is modified and every night. After more than ten failed login attempts—including on wp-admin—the IP address is redirected to a CAPTCHA page, which significantly slows down brute-force attacks. Your plugins and passwords, however, remain your responsibility. If you do get hacked, we’ll look into WordPress hacked We identify the cause and fix it. Everything you need to know about prevention is in WordPress Security: The Complete Guide.
Frequently Asked Questions
Can my site be hacked through another site on the same server?
This is the case with poorly isolated shared hosting. At Surver, every shared hosting account is protected by CloudLinux and CageFS, so an infection in one account cannot spread to others. Sites within your own account are not isolated from one another, and that’s what cause 7 is about.
Can a plugin update itself cause a hack?
This rarely happens, but it is possible if a plugin is compromised or the developer is hacked. Therefore, only install plugins from a trusted source and follow security alerts from WPScan, Patchstack, or the NCSC.
How can I prevent this from happening again?
First, find the cause and fix it; otherwise, the next hack is only a matter of time. Then, set up regular updates, two-factor authentication for all administrators, and a firewall.
