Every few months, a report lands that attackers are going after recently fixed WordPress bugs, and millions of sites are described as exposed. The warning sounds dramatic but the story is repetitive: a vulnerability is found, a patch is released, and criminals race to attack everyone who has not updated yet. The good news is that the defense is also repetitive, and most of it is within the reach of any site owner.
Why patched bugs still get exploited
A patch is a roadmap. Once it is public, attackers can compare the old and new code, learn exactly what was wrong and write a tool to find vulnerable sites automatically. Within days, scanners are probing the internet for sites that still run the old version. Because WordPress powers a large share of the web, even a small proportion of unpatched sites is a big pool of targets.
Most real-world damage comes from plugins and themes, not from the core software. Thousands of third-party add-ons exist, quality varies, and some are abandoned by their authors yet remain installed on live sites.
What attackers do once they get in
- Create hidden administrator accounts to keep access.
- Inject spam links or redirect visitors to scam pages.
- Install backdoors that survive cleanup attempts.
- Steal customer data from forms and stores.
- Use the server to send spam or attack other sites.
The ten-minute emergency checklist
- Back up first. Take a full copy of files and database, stored away from the server.
- Update everything. Core, plugins and themes. Prioritize the ones named in security advisories.
- Remove what you do not use. Deactivated plugins can still be exploited, so delete them.
- Check users. Look for administrator accounts you do not recognize and remove them.
- Change passwords. Admin accounts, hosting, database and FTP, using a password manager.
- Turn on two-factor authentication for all administrators.
Make updates a routine, not an emergency
Automatic updates for minor core releases are already on by default for most installations. For plugins, consider enabling automatic updates for those you trust and testing major changes on a staging copy first. Set a weekly reminder to review pending updates. If you run an online store or membership site, schedule a monthly check where you test checkout and login after updating.
Hardening that pays off
- Use a firewall. A web application firewall can block known attack patterns before they reach WordPress, giving you time to patch.
- Limit login attempts and consider hiding or restricting the default login page.
- Disable file editing inside the dashboard so that a compromised admin cannot modify code.
- Use least privilege. Give writers editor accounts, not administrator accounts.
- Keep PHP current. Old versions lose security fixes.
- Choose hosting carefully. Good hosts isolate accounts and monitor for malware.
How to pick plugins more safely
Before installing anything, check when it was last updated, how many active installs it has and whether the author responds to support questions. A plugin untouched for two years is a risk, even if it still works. Prefer one tool that does several jobs over four tiny ones from different authors, since every extra plugin is another door. Read the changelog for security fixes, and subscribe to a vulnerability feed for the add-ons you rely on so that you hear about problems the day they are published rather than the day your site misbehaves.
How to tell whether you have been hacked
Signs include unexpected pages in search results, redirects on mobile only, new admin users, warnings from your browser or search engine, a sudden slowdown and files with recent modification dates that you did not touch. Run a malware scanner, compare core files against clean copies from the official source, and check the web server’s access logs for suspicious requests.
If the worst happens
Take the site offline or put it in maintenance mode. Restore from a backup made before the infection, then immediately apply updates and change every credential, because restoring alone leaves the original hole open. If you have no clean backup, a professional cleanup may be cheaper than days of guesswork. Afterwards, ask your search engine to re-review the site if it flagged you, and tell customers if their data may have been affected, as the law in many places requires.
The bottom line
You do not need to be a security expert to keep a WordPress site safe. You need a habit: update quickly, keep fewer plugins, use strong authentication and keep a recent backup somewhere else. Attackers rely on neglect. Remove that, and most of the threat goes with it.
