Web TeamA lot of owners think, “Nobody would bother hacking my little site.” That’s not how it works. Most attacks are run by bots. They scan millions of sites looking for one known weak spot. They don’t care who you are.
So here’s what actually gets sites broken into, using real numbers from the people who track this.
The big picture
Patchstack publishes a yearly report on WordPress security. Their 2026 report covers what they found in 2025:
- 11,334 new security holes were found across WordPress plugins, themes, and core. That’s 42% more than the year before.
- 91% were in plugins. 9% were in themes.
- Only 6 were in WordPress core, and all 6 were low priority.
- 1,966 were rated likely to be used in mass attacks.
The takeaway is simple. WordPress itself is pretty solid. The add-ons are where the trouble is.
The main ways sites get hacked
Outdated plugins and themes
This is number one. A security hole gets found. A fix comes out. Bots start scanning for sites that haven’t updated. Patchstack reports that for the most attacked holes, the first attack attempts came within about 5 hours of the hole going public. That’s the median, so half came even faster.
If your updates wait for someone to remember, you’re behind.
Plugins with no fix at all
According to Patchstack’s 2026 report, 46% of the holes had no fix from the developer when they were made public. That usually means the plugin is abandoned or slow to respond. Updating won’t help you there. You need to replace the plugin.
Weak or shared passwords
Bots try common passwords on your login page all day. If your admin password is your business name and the year, they’ll get in. Shared logins make it worse, because nobody knows who changed what.
Old server software
WordPress runs on PHP. As of October 2026, PHP 8.1 and older get no security fixes. In October 2026, the PHP team put out urgent updates for 8.2 through 8.5 to fix two critical holes that could let an attacker run code on the server without logging in. If your host hasn’t applied those, ask them today.
WordPress core, now and then
Core holes are rare but they happen. WordPress 7.1.4, released October 28, 2026, fixed 22 security issues. One of them could let an attacker run code during a core update. If your site gets automatic updates, it likely already has the fix. Check anyway.
What a hack looks like for a small business
It’s rarely dramatic. Usually it’s one of these:
- Your site sends visitors to spam or scam pages
- Google flags your site with a warning
- Your hosting account gets suspended
- Your email gets marked as spam because your server is sending junk
- A new admin user appears that nobody created
Cleanup can take days. Lost trust takes longer.
Security checklist
- WordPress core, plugins, and themes update on a set schedule, at least weekly
- Remove any plugin or theme you don’t use, including inactive ones
- Replace plugins that haven’t been updated in over a year
- Every user has their own login with a strong, unique password
- Two-factor login is turned on for all admin accounts
- Only people who need admin access have it
- Your host runs a supported PHP version (8.3 or newer is safest as of October 2026)
- A firewall or security service blocks known attacks
- Daily backups are stored off the server
- Someone reviews user accounts every few months
Don’t try to do it all yourself
You don’t need to be a security expert. You need someone checking these things every week so you don’t have to. That’s the whole point of a managed plan.
Want to know if your site has any of these problems right now? Book a free 30-minute website audit. We’ll look at it together on a call.
