The numbers are stark. In 2025, 11,334 new vulnerabilities were found in the WordPress ecosystem — a 42% increase compared to 2024. Approximately 13,000 WordPress sites are hacked per day, and the median time from vulnerability disclosure to mass exploitation is just five hours. That last figure is the one that should change how you think about maintenance windows and “I’ll get to it later” update habits.
The uncomfortable truth, though, is that most of those compromised sites share the same handful of avoidable mistakes. Research shows over 86% of hacked WordPress sites had obvious security lapses like no backups, outdated software, or weak passwords — and most attacks are entirely preventable by avoiding basic security mistakes. What follows is a direct breakdown of those mistakes and exactly what you need to do about each one.
Mistake 1: Running Outdated Plugins and Themes
This is the single biggest attack vector in the WordPress ecosystem — and it isn’t close. Patchstack’s State of WordPress Security in 2026 whitepaper reports that 91% of new vulnerabilities in 2025 were found in plugins. Over 9 out of 10 successful attacks on WordPress sites in 2025 came from plugin and theme vulnerabilities — not from CMS core flaws. Plugins are the weakest link in the ecosystem and the primary attack vector.
Here is the mechanics of how this plays out: Every WordPress plugin update includes a changelog. When that changelog mentions a “security fix,” it means a vulnerability was discovered and patched. The moment that patch is published, attackers know exactly what to look for on unpatched sites.
The first automated attacks exploiting a newly disclosed vulnerability appear on average within five hours of publication. The first 24 hours after disclosure are the critical window — every hour of delay in updating increases risk.
Equally concerning: 46% of vulnerabilities have no patch at the time of disclosure. That means even a diligent updater can be exposed. A Web Application Firewall (WAF) that provides virtual patching is essential for bridging that gap.
Fix: Enable automatic updates for minor WordPress core releases. Review plugin updates at least weekly — more often for high-traffic or e-commerce sites. Remove any plugin or theme you are not actively using. Plugins whose authors have stopped development will never receive security patches. They remain on the site as permanent vulnerabilities. Pair timely updates with a WAF or a managed security layer for the gap between disclosure and patch availability.
Mistake 2: Using Weak Passwords and Skipping Two-Factor Authentication
You’d be surprised how many sites still use “admin” as the username or a password like “12345678.” In 2025, brute-force attacks — where bots guess your login over and over — are still super common. In 2025, brute force attacks increased by 45%, driven by AI-powered botnets that can bypass traditional CAPTCHA and mimic human login patterns.
81% of hacked WordPress sites involved weak or stolen passwords as a contributing factor. Wordfence, the most widely deployed WordPress security plugin, blocks over 6.4 billion brute force attacks every single month across its network. That is not a spike — it is the permanent baseline.
Fix: Use a unique password of 16 or more characters with symbols for every WordPress account. Rename or delete the default “admin” username immediately after installation. Enable two-factor authentication (2FA) via a plugin such as WP 2FA or Google Authenticator. Consider limiting login attempts and restricting wp-admin access by IP address where practical.
Mistake 3: No Offsite Backups — or No Backups at All
Backups are not a security measure in the traditional sense, but they are your only true recovery plan when every other layer fails. When ransomware hits, no offsite backup means total loss. An on-server backup is nearly as bad — a compromised server can corrupt or delete local backup files alongside everything else.
The average total recovery cost for a small business after a hack is $14,500 — far beyond the cost of even a premium backup solution. A good backup strategy costs a fraction of that per month.
Fix: Automate daily backups and store them offsite — Google Drive, Amazon S3, Dropbox, or a dedicated remote server. Test your restores. A backup you have never restored is a backup you cannot trust. Solutions like UpdraftPlus, BlogVault, or Jetpack Backup make this straightforward. On our WordPress hosting plans, automated offsite backups are built in so this step is already covered.
Mistake 4: Leaving the Default Login URL Untouched
Bots target the default /wp-login.php URL millions of times daily. Wordfence blocked over 100 billion credential stuffing attacks from 74 million unique IP addresses in a single year — the vast majority targeting the standard /wp-login.php and /wp-admin paths. Keeping the default URL does not make an attack possible, but it does make automated scanning trivially easy.
Fix: Use a plugin such as WPS Hide Login to move the login page to a non-standard URL. This alone will not stop a determined attacker, but it removes your site from the vast majority of automated scans that target only the default path. Combine it with 2FA and login attempt limiting for layered protection.
Mistake 5: Incorrect File Permissions
Loose file permissions give attackers — or compromised plugins — the ability to write, modify, or execute files they should never be able to touch. This is a common misconfiguration that often goes unnoticed until it is exploited.
Fix: Follow the WordPress-recommended permission model: 755 for directories, 644 for files, and 600 for wp-config.php. Never set files or directories to 777. While you are at it, add this line to wp-config.php to disable the built-in theme and plugin file editor, which is a common pivot point for attackers who gain admin access:
define('DISALLOW_FILE_EDIT', true);Hackers love the built-in Appearance > Theme Editor. Disabling file editing via wp-config.php removes that attack vector entirely.
Mistake 6: Installing Nulled Plugins and Themes
Free copies of premium plugins or themes distributed outside official channels — commonly called “nulled” software — are one of the most reliable ways to introduce malware to your own site. They often contain backdoors, and experienced security professionals have removed malware from nulled plugins countless times.
Using trusted themes and plugins has generally been better for security, but even the most popular themes and plugins aren’t immune to malicious attacks. Nulled software removes even that baseline of accountability.
Fix: Only install plugins and themes from the official WordPress.org repository or trusted, reputable marketplaces. Choose from reputable developers with a strong track record of security updates and ongoing support, and always check when they were last updated and whether they have a history of quickly patching vulnerabilities.
Mistake 7: No SSL/HTTPS
Some sites are still not using HTTPS. If yours isn’t, you’re putting user data at risk and hurting your SEO. Browsers like Chrome literally flag these sites as “Not Secure” — not a great first impression. Beyond the user experience issue, unencrypted traffic exposes login credentials, session cookies, and form data to interception.
Fix: Get a free SSL certificate from Let’s Encrypt or your hosting provider, and redirect all HTTP traffic to HTTPS. All hosting plans at 978host include SSL at no additional cost. Once HTTPS is active, use a plugin or your .htaccess file to enforce the redirect and set an HSTS header.
Mistake 8: Choosing the Wrong Hosting Environment
No amount of plugin-level hardening fully compensates for a weak hosting environment. An insecure website hosting environment can lead to data breaches and unauthorized access. Weak server configurations and insufficient security measures contribute directly to these vulnerabilities.
Many WordPress users rely solely on security plugins for protection. While these plugins add a layer of security, they aren’t often enough to protect a WordPress website completely, especially when cybercriminals are getting smarter. Server-level defenses — firewalls, malware scanning, isolated environments, and intrusion detection — need to be in place before a single plugin is installed.
Fix: Choose a host that offers server-level malware scanning, isolated hosting accounts, automatic core updates, and regular security auditing. Our managed WordPress hosting includes these layers by default. If you are unsure whether your current setup is adequately hardened, contact us for a review.
Mistake 9: No Security Monitoring or Alerting
With AI on the rise, hackers can now mass-scan WordPress sites to identify and exploit vulnerabilities faster than ever. You need a multi-layer strategy that includes real-time monitoring, proactive updates, and a solid WordPress security foundation. Without active monitoring, you will often find out about a compromise from Google Search Console — or from a customer.
Fix: Install a security plugin that provides file integrity monitoring and real-time alerting (Wordfence, Sucuri, or Solid Security are all solid choices). Enable login notifications for admin accounts. Set up uptime monitoring so you know immediately if your site goes down. Review your activity logs periodically for anything unusual — unexpected admin account creation, plugin installs you did not initiate, or content changes.
A Quick Security Hardening Checklist
- WordPress core, all plugins, and all themes updated immediately upon release
- Unused plugins and themes deleted — not just deactivated
- Strong, unique passwords on every user account; no “admin” username
- Two-factor authentication enabled for all administrator accounts
- Default login URL changed
- Login attempt limiting active
- SSL/HTTPS enforced sitewide
- Daily automated backups stored offsite with tested restores
- File permissions set to
755/644/600 - File editing disabled in
wp-config.php - A Web Application Firewall (WAF) active at the application layer
- Real-time security monitoring and alerting configured
- Plugins and themes sourced only from trusted, maintained repositories
The Bottom Line
Most attacks are automated and opportunistic. They scan for known vulnerabilities in outdated plugins. If your site is updated and hardened, the bots move on to easier targets. Security is not about being impenetrable — it is about not being the easiest target on the block.
Securing your WordPress site is a continuous process. Avoiding common mistakes and proactively adopting security measures will help fortify your site against threats. The good news is that the list of mistakes is finite and every fix is within reach — most take less than an hour to implement.
If you would rather have a professional handle the hardening, monitoring, and ongoing maintenance, that is exactly what our managed WordPress hosting is built for. We handle server-level security, updates, backups, and monitoring so you can focus on running your business. Take a look at our pricing or contact us to talk through what your site needs.