Most hacked WordPress sites are not victims of some brilliant, targeted attack. They are victims of automation — bots that scan thousands of sites an hour, looking for the same handful of open doors. Close those doors and you are no longer low-hanging fruit. Here are the seven most common ones, and how to shut each.
The single most common way in. Automated tools try thousands of common passwords against your login page every day. If your admin password is short, guessable, or reused from another site that has been breached, it is only a matter of time.
The fix: use a long, unique passphrase for every admin account, enable two-factor authentication, and limit failed login attempts so an IP is locked out after a few tries. Brute-force protection turns an unlimited guessing game into a dead end.
XML-RPC is a legacy WordPress feature almost no modern site needs. Attackers love it because it lets them amplify brute-force attempts and, in some cases, launch denial-of-service attacks through your own site.
The fix: disable XML-RPC entirely unless you have a specific, current need for it. It removes an entire category of attack in one step.
The majority of WordPress compromises trace back to a known vulnerability in an out-of-date plugin — one that was already patched, but never updated on the site. Attackers scan specifically for these known holes.
The fix: update core, plugins and themes on a regular schedule, and remove anything you are not actively using. Every plugin you keep is a door you have to maintain; every one you delete is a door that no longer exists.
By default, WordPress will happily tell an attacker your usernames through author archives and its REST API. Once they have a valid username, half the login puzzle is solved and brute-forcing gets far easier.
The fix: block author-scan URLs and hide the users endpoint from anonymous visitors, so attackers cannot harvest the list of who to target.
When a site is compromised, one of the first things attackers do is drop a small malicious script — a “web shell” — that gives them ongoing control. The uploads folder is a favourite hiding spot because that is where file uploads land.
The fix: configure the server so PHP files simply cannot execute inside the uploads directory. Even if a malicious file gets in, it cannot run.
Here is the uncomfortable truth: most site owners do not discover a breach themselves. They find out when Google flags the site, when their host suspends it, or when a customer complains. By then the damage — to rankings, to reputation, to data — is done.
The fix: monitor the site’s core files daily against known-good versions, so any modified, missing or unexpected file is flagged the moment it appears. Detection in hours instead of months changes everything.
A lock keeps honest people out. Detection and response are what actually protect you when someone gets past the lock — and eventually, someone always tries.
The most expensive mistake of all is thinking security is something you “did” once. New vulnerabilities appear constantly, plugins fall out of date, and the threat landscape shifts every month. A site that was secure last year may be wide open today.
The fix: treat security as an ongoing service, not a task. That means continuous hardening, regular updates, always-on monitoring, and someone actually watching the alerts — ready to respond when something looks wrong.
Notice the theme: none of these require genius to exploit, and none require genius to prevent. They require discipline — the unglamorous, repeated work of closing doors and watching them. That is exactly the kind of work that is easy to intend and hard to keep doing, which is why so many sites drift back into vulnerability.
It is also exactly why a managed approach exists: so the hardening, the updates, the monitoring and the response happen every week without depending on anyone remembering to do them.
Our Managed SEO & Security care plans close every door on this list — and watch them around the clock. We run the same system on our own site.
