How WordPress sites actually get hacked (it is usually a plugin)
When a WordPress site is compromised, the owner often concludes that WordPress itself is insecure. That is rarely what happened. WordPress core is reviewed by a dedicated security team and patched quickly. The weak points are almost always around it.
Out-of-date plugins and themes
The large majority of publicly reported WordPress vulnerabilities are found in plugins and themes, not in core. Once a fix is released, the details of the flaw become public, and automated bots begin scanning for sites that have not updated yet.
This is why the gap between a patch being released and you installing it matters more than almost anything else you can do.
Abandoned plugins
A plugin that has not been updated in years will not receive a fix when a flaw is found. It can sit on a site, working perfectly, until the day it is the way in. Part of routine maintenance is checking not just whether updates are available, but whether each plugin is still being maintained at all.
Weak and reused passwords
Bots try leaked username and password combinations against WordPress login pages constantly. If an administrator reuses a password that appeared in a breach somewhere else, no amount of plugin updating will help.
- Use a unique, generated password for every administrator
- Turn on two-factor authentication for anyone who can install plugins
- Remove accounts for people who no longer need access
Nulled themes and plugins
Pirated copies of premium plugins are a common source of malware. If a paid plugin is being offered for free on an unofficial site, assume something has been added to it.
What sensible protection looks like
There is no single product that makes a site secure. What works is a boring routine carried out consistently:
- Apply updates promptly, after testing them on a staging copy
- Remove plugins and themes you are not using
- Keep tested backups stored away from the web server
- Limit who has administrator access
- Monitor for unexpected file changes and logins
None of this is exciting. All of it is far cheaper than cleaning up after a compromise.