Why WordPress sites get hacked (and how to avoid it)
Strange products, spam links or a site that goes down: signs of a hacked WordPress site. Why it happens, how to spot it and how to prevent it.
One day you search for your business on Google and under your name appear product titles you do not sell, pages in other languages or ads for things you would rather not mention. Or the browser warns that your website is dangerous. It is more common than it seems, and it almost always has the same origin: a WordPress site nobody looks after, which ends up hacked.
It is not personal
Hardly anyone attacks a clinic's or a school's website by hand. Bots do it, endlessly crawling the internet for known flaws. When they find one, they exploit it automatically on thousands of websites at once. Your website does not have to be important to fall: it just has to have the door open.
How a WordPress site gets hacked
Outdated plugins and themes
The number one cause. A plugin has a flaw, its authors publish a fix, but the website is never updated and the flaw is still there, documented and within reach of any bot.
Abandoned or "nulled" plugins
Plugins nobody has maintained for years, or paid plugins downloaded for free from dubious sites, which sometimes come with malicious code already inside.
Weak passwords
The admin login (/wp-admin) is visible to everyone. With simple passwords and no two-factor authentication, brute-force attacks eventually get in.
Careless shared hosting
If another website on the same server is compromised and the host does not isolate them well, the problem can spread.
How to tell if your WordPress site is hacked
- Search Google for "site:yourdomain.com" and see if pages you do not recognise appear.
- Check Google Search Console: it flags security issues and strange indexed pages.
- Check whether the website redirects elsewhere from mobile or from Google, even if it looks normal on your computer.
- See whether there are admin users you did not create.
What to do with a hacked WordPress site
- Do not delete things at random: make a full copy so it can be analysed.
- Change every password (WordPress, hosting, database, email).
- Clean or, better, rebuild the website from a clean copy or from scratch.
- In Search Console, request removal of the spam pages and ask Google to review the site.
- Find out how they got in, or it will happen again.
How to stop your WordPress site being hacked
With WordPress, the recipe is well known and demands consistency: update everything often, use only essential, trusted plugins, strong passwords with two-factor authentication, automatic backups and someone keeping watch.
The other option is to remove the doors. A static website has no public login, no plugins and no database to attack. For a business whose website changes little, it is usually the most stress-free way to have a secure website without paying monthly maintenance.
That is how I work at Nueva Página. For a calm comparison, see WordPress or a custom website.
Why a static website has fewer doors
WordPress runs code every time someone visits: it queries the database, loads plugins and builds the page on the spot. Each of those pieces is a possible door. By contrast, a static website serves pages that are already built, with no database or plugins exposed, so there is far less to attack.
That does not mean WordPress is bad; it means it has to be maintained. Its own official documentation has a guide to hardening WordPress, covering updates, passwords and permissions. If you will not deal with that every month, another option may suit you better: compared in WordPress or custom website. The safest website is the one with the fewest pieces to watch.
Frequently asked questions
Is WordPress insecure?
WordPress core is well maintained. The risk lies in un-updated installations and third-party plugins, which is exactly the situation of many small business websites.
Will a security plugin fix it?
It helps, but it does not replace updates. A security plugin on a website with vulnerable plugins is like an alarm with the door left open.
Will Google penalise a hacked WordPress site?
It may show warnings to users and drop pages while there is malicious content. Once the website is clean and you report it in Search Console, it recovers.
Do Nueva Página websites use WordPress?
No. They are custom-built static websites, with no plugins to update, published over a secure connection. See how I work.