dan The call always sounds the same. The site is redirecting to a pharmacy page, or Google is showing a red warning screen, or the host suspended the account. And the first question is always: “Why would anyone attack us? We’re a small business.”
Nobody attacked you specifically. That’s the thing to understand before anything else makes sense.
Nobody picked you
The overwhelming majority of WordPress compromises are automated. Bots crawl the entire internet looking for one thing: a known vulnerability in a known version of a known plugin. When a security flaw gets disclosed publicly — which happens weekly — those bots start scanning for every site still running the unpatched version. Your site isn’t a target. It’s a match on a list.
This is oddly good news. If the attacks are generic, the defenses can be generic too. You don’t need a security team. You need to stop being on the list.
The four ways sites actually get in trouble
Outdated plugins
This is the big one, and it isn’t close. WordPress core is well-maintained and fast to patch. Plugins are a different story — thousands of developers with wildly varying standards, and plenty of plugins that were abandoned years ago and still sit installed on hundreds of thousands of sites.
Every plugin you install is code someone else wrote running on your server. Every abandoned plugin is code nobody is fixing anymore. The site running eighteen plugins where six haven’t been updated since 2022 isn’t a hypothetical — that’s most of the sites we’re asked to clean up.
Weak logins
admin as a username, a password that appears in any breach dump, no two-factor. Bots try thousands of combinations against your login page every day whether you notice or not. Most sites have no rate limiting, so the bots get unlimited attempts.
Cheap shared hosting
On budget shared hosting, your site sits alongside hundreds of others on the same server. If one of them gets compromised and the host’s isolation is weak, the infection can spread sideways. You did nothing wrong and you’re infected anyway.
Nulled themes and plugins
Someone found the premium plugin for free on a sketchy site. It works fine. It also has a backdoor — that’s the entire business model of distributing them. This is the one that stings, because it was preventable for the price of a license.
What real protection looks like
There’s no single product that makes you safe. Layers do the work:
Keep everything updated, on a schedule. Core, plugins, themes, PHP version. Not “when I remember.” Uninstall anything you’re not actively using — an inactive plugin is still code on your server.
Harden the login. Strong unique passwords, two-factor, no admin username, rate limiting on login attempts.
Host on infrastructure built for WordPress. Proper isolation, a web application firewall, malware scanning, and a host that actually knows the platform.
Take backups you’ve tested. An untested backup is a hope, not a plan. Backups should be automatic, off-server, and restored at least once so you know they work.
Limit user access. Not everyone needs to be an administrator. Give people the lowest role that lets them do their job.
If you’re already compromised
Don’t just delete the visible damage. Attackers leave backdoors specifically so cleanup doesn’t lock them out — that’s why sites get “cleaned” and reinfected a week later. Take the site offline, restore from a backup you know predates the infection, patch whatever they came in through, rotate every password and key, then request review from Google if you got flagged.
If you don’t know when the infection started, a restore alone won’t save you. That’s the point where professional cleanup is cheaper than guessing.
How we handle security at 914Digital
Every site we build sits on managed hosting with updates, monitoring, backups, and active security handled on our side. It’s part of the managed care plans rather than an upsell, because a site that goes down or gets flagged isn’t doing the job we built it to do.
If you’re not sure what’s running on your site or when it was last updated, we’ll take a look.
Frequently asked questions
Is WordPress less secure than other platforms? No. WordPress powers a huge share of the web, so it gets attacked more in absolute terms. Core is well-secured. The risk lives in plugins and maintenance habits.
Will a security plugin protect me? It helps and it isn’t sufficient. A security plugin on a site with six outdated plugins is a lock on a door with no frame.
How often should updates run? Security patches, as soon as they’re available. Everything else on a regular schedule with a staging environment so an update doesn’t break the site.
My site is small. Am I really at risk? Size is irrelevant to an automated scanner. It’s checking for a vulnerable version, not reading your revenue.
