WordPress security: the complete guide
WordPress powers most of the web, and that is exactly why it is the number one target for automated attacks. The good news: the core itself is solid and quickly patched. The risk almost always lies elsewhere, in outdated plugins, weak passwords, pirated add-ons and missing backups. This guide gathers everything you need to know in one place, from real, high-profile flaws to what to do when a site is already down.
The most dangerous flaws: full site takeover
Vulnerabilities that let a stranger run their own code on the server or change content without logging in. The top of the threat list.
A critical WordPress flaw, your site can fall within hours Security
CERT Polska warns of a critical WordPress flaw that lets an attacker take over a site without logging in. Check in 2 minutes whether your version is safe.
How one flaw rewrote the content of 1.5 million WordPress pages Security
In 2017 a small bug in WordPress let strangers edit any post on a site, without logging in. Within days the content of over 1.5 million pages was rewritten. Here is what the story teaches.
The File Manager plugin, 700,000 sites up for takeover in one afternoon Security
A popular file management plugin had a flaw that let a stranger upload their own code to the server. Without logging in. Bots started exploiting it within hours.
A theme runs code too, the story of the Bricks Builder flaw Security
Many people think only plugins are dangerous. Yet in 2024 the popular Bricks builder/theme let strangers run their own code on the server, without logging in.
Webshell, how one uploaded file hands the server to strangers Security
The most dangerous type of flaw is the one that lets someone upload their own file with code onto the server. Such a file, a webshell, gives an attacker full remote access to the site.
Plugins and themes: the biggest attack surface
Most break-ins go through add-ons, not the core. See how a single plugin can hand over the whole site.
A wave of attacks on WordPress plugins, check whether you use any of these Security
Several popular WordPress plugins have just come under fire. Attackers take over sites en masse, often before the owner notices. Check the list and protect yourself.
Even a speed-up plugin can let a burglar in Security
LiteSpeed Cache is one of the most popular WordPress speed plugins, 5 million installs. In 2024 it had a flaw that let a stranger become an administrator.
A million sites, one Elementor add-on and an admin password reset Security
The more popular an add-on, the wider a flaw's blast radius. Essential Addons for Elementor, over a million installs, let anyone reset any account's password in 2023.
When a "security" plugin lets the burglar in itself Security
Pure irony: a popular security plugin on 4 million sites had a flaw that let you log in as any user, including the administrator.
You register as an ordinary user, you walk out as an administrator Security
Membership plugins can be a back door. A flaw in Ultimate Member let you become a site administrator right at registration, and it was exploited in the wild.
An abandoned plugin, a quiet problem you will not notice Security
Some plugins disappear from the official WordPress directory, the author abandons them or they are removed because of a flaw. On your site they keep working, except the patch will never come.
A "free" version of a paid plugin? The most expensive mistake on a site Security
Pirated plugins and themes (so-called nulled) tempt with a "free" price. In reality they very often contain hidden malicious code. We explain why it is a trap and how to avoid it.
WP-VCD, how pirated plugins infect the whole site Security
Behind a "free" version of a paid plugin there is often ready-made malware. WP-VCD is one of the most widespread families of WordPress infection and a classic example of how it works.
Login, passwords and access
The most common way in is not a sophisticated flaw but a guessed or stolen password.
Brute-force login attacks, how to defend yourself Security
Bots try to guess your panel password non-stop. We explain how a brute-force attack works and five things that close the door on it.
Nobody "hacked" you, you just reused the same password Security
Not every break-in is a sophisticated attack. Most often the attacker simply types in a password that leaked from a completely different service. It is called credential stuffing.
The password "Company123!" will not protect your site, do this instead Security
The most common way into a site is not a sophisticated attack, but a weak password. Here is how to close that door in a few minutes, a password manager and two-factor login in plain words.
A password manager, why it is worth it and how to start Security
The same passwords over and over is asking for trouble. A password manager solves the problem once and for all, we explain how it works and why it is safe.
How to safely give an agency or freelancer access to your site Security
You outsource changes to your site and have to give someone access. We show how to do it safely, so you do not hand over the keys to the whole kingdom.
XML-RPC in WordPress, is it worth disabling? Security
XML-RPC is an old WordPress mechanism that today serves attackers more often than site owners. We explain in plain words what it is and when it is safe to disable.
Attack techniques worth understanding
Briefly and in plain words: how the most common attack methods on websites work.
SQL injection in plain words, how one field leaks the whole database Security
One of the oldest and still most dangerous attacks. Through a poorly protected form field, an attacker can pull logins, passwords and customer data out of the database.
XSS, how someone else's script hijacks the admin session Security
Cross-Site Scripting is planting a foreign script on your site that runs in the browser of your visitors, and sometimes in the browser of a logged-in administrator.
WooCommerce stores
E-commerce is a double target: customer data and money. It needs more attention.
A shop is a tempting target, how a payments flaw hands the panel to strangers Security
In 2023 a flaw in the WooCommerce Payments plugin let a stranger pose as the shop administrator. With a single request header. WordPress had to force updates.
WooCommerce, 8 things that protect your shop and customers Online stores
WooCommerce powers millions of shops, and that is exactly why it is a target. Here is a concrete list of protections that make a difference, without technical jargon.
When a break-in has already happened
How to recognise an infection and what to do first, step by step.
How to tell your WordPress site has a virus Security
Strange redirects, Google warnings, spam in the search results. Five signs that someone unauthorised has taken over your site, and what to do then.
Site hacked? The first hour decides everything Security
You already know something is wrong, redirects, a Google warning, strange files. What now? Here is a plan for the first hour: what to do in order and what not to do under any circumstances.
You cleaned the site and the virus came back? Backdoors are to blame Security
The site gets cleaned, and a few days later the infection returns. It is not bad luck or a "strong virus", it is a backdoor nobody removed. We explain how to break the cycle.
Your site redirects to foreign ads? That is a sign of a break-in Security
You open your own site and it suddenly throws you onto a shady ad or someone else's service. It is a classic symptom of infection, we explain what is happening.
Google flagged your site as dangerous, what to do Security
The red "This site may be dangerous" screen scares off customers and cuts traffic. We explain where it comes from and how to get off the blacklist.
Protective layer and hygiene
Simple habits that genuinely raise security and limit the impact of any attack.
Security headers (HSTS, CSP) in plain words Security
Security headers are quiet instructions your server sends to the browser. Set well, they protect visitors without changing how the site looks.
Afraid to click "update"? Here is how to do it without breaking the site Care and backups
Updates are essential for security, but sometimes something stops working afterwards. So many people avoid them, and that is worse. Here is how to update safely.
A website backup, the insurance everyone forgets about Care and backups
A backup is boring until it is the one thing that saves your business. Why it is worth having a backup and how often to make one.
The 3-2-1 rule for backups, simple and effective Care and backups
A backup only makes sense if it survives the disaster that destroyed the original. The 3-2-1 rule is a proven way to make sure it does.
A site without support is a site without patches, the quiet end of security Security
The most dangerous site is the one running a CMS version that no longer receives fixes. New flaws keep appearing, but patches do not. And nobody will warn you.
Frequently asked questions
Is WordPress safe?
Yes, the WordPress core is solid and quickly patched. The vast majority of break-ins result from outdated plugins and themes, weak passwords or pirated add-ons, not a hole in the system itself.
What most often leads to a break-in?
Outdated plugins and themes, reused or weak passwords, pirated ("nulled") add-ons, and the lack of a backup that would let you quickly return to a clean state.
How fast do you need to update after a flaw is found?
In hours, not days. As soon as a flaw becomes public, bots start mass-scanning the internet for unpatched sites; the first attacks often begin the same day.
What should you do when a site is already hacked?
Do not delete everything blindly. Make a copy of the current state, change passwords, find and close the door the intruders came through, and only then clean up. Otherwise the infection comes back.
Prefer someone to keep an eye on this for you?
Send us your website address; we will check it for threats and performance and prepare a free care quote.
Request a free audit →