WordPress runs more than 40% of the web. That popularity has a flip side: it’s the platform most targeted by hackers. But here’s the reassuring truth — almost all WordPress hacks aren’t targeted attacks by hacking geniuses. They’re automated, opportunistic attacks that exploit known flaws on poorly maintained sites. In other words: most are avoidable with simple measures. This guide details them.
A hacked site isn’t just a technical nuisance: it’s a leak of customer data (and a GDPR risk), SEO destroyed by malicious redirects, a damaged reputation, and sometimes weeks of cleanup. Better to prevent. Target audience: WordPress and WooCommerce site owners who want to sleep soundly, without being cybersecurity experts.
How WordPress sites get hacked
Understanding attack vectors means knowing where to act. The most frequent entry points:
- Outdated plugins and themes — by far the leading cause. A known flaw in an unupdated plugin is an open invitation.
- Weak passwords — brute-force attacks test thousands of combinations on the login page.
- Plugins from dubious sources — “nulled” (pirated) versions of premium plugins, often riddled with malicious code.
- Insecure hosting — a poorly isolated shared environment spreads an infection from one site to another.
- No monitoring — many sites are infected for weeks without anyone noticing.
The 12 essential measures
1. Update, systematically
WordPress core, plugins and themes must be kept up to date. It’s the most important and most neglected measure. Ideally in a controlled framework (test on staging before production) so an update doesn’t break the site.
2. Strong, unique passwords
Every admin account needs a long, random, unique password. A password manager makes this painless. Banish “admin / admin123.”
3. Two-factor authentication (2FA)
2FA adds a second proof of identity (a temporary code on the phone). Even if a password leaks, the account stays protected. It’s one of the best effort/effectiveness protections.
4. Limit login attempts
Blocking an address after several failed logins neutralises brute-force attacks. Changing the default login URL (/wp-admin, /wp-login.php) adds a useful layer of obscurity.
5. The principle of least privilege
Give each user only the rights they need. An editor doesn’t need admin access. Fewer high-privilege accounts, less attack surface.
6. Uninstall what you don’t use
Every inactive plugin and theme remains a potential flaw. Delete (not just deactivate) anything unused. A lean site is a safer site.
7. Install only from trusted sources
Plugins and themes only from the official WordPress.org repository or recognised vendors. Never a “nulled” version: saving a few euros is paid for with a guaranteed infection.
8. A web application firewall (WAF)
A WAF filters malicious traffic before it reaches your site (injections, scans, bots). It blocks the majority of automated attacks upstream.
9. HTTPS everywhere
The SSL certificate encrypts exchanges between visitor and site. Essential for security, trust, GDPR and SEO. In 2026, a site without HTTPS is unacceptable.
10. Automatic, off-site backups
Backup is your ultimate safety net. Automatic, regular, stored elsewhere than the site’s server (otherwise an infection takes the backups too), and — crucially — tested. A backup you can’t restore is worthless.
11. Harden the configuration
Several settings reduce the attack surface: disable the file editor in the admin, protect the wp-config.php file, disable XML-RPC if unused, hide the WordPress version. These technical measures are part of standard hardening.
12. Monitor and scan
A regular malware scan and file-integrity monitoring detect an infection early — before it does damage or destroys your SEO. Early detection changes everything.
The e-commerce case: heightened stakes
For a WooCommerce store, security takes on an extra dimension: you handle payment data and personal information. A flaw is no longer just technical, it becomes legal and financial. The measures above are a minimum, complemented by particular vigilance on payment extensions and compliance.
What to do if your site is hacked
If the worst happens, panic is a poor adviser. The procedure:
- Isolate — put the site in maintenance to stop the spread and protect visitors.
- Identify — determine the entry point and extent of infection (modified files, created accounts).
- Clean — remove the malicious code, or restore a clean backup from before the infection.
- Secure — change all passwords, update, close the exploited flaw.
- Monitor — check for re-infection and ask Google for a re-review if the site was flagged.
It’s delicate work where every step counts — exactly the kind of intervention we carry out.
In practice
WordPress security isn’t a product you buy once: it’s a state you maintain. The 12 measures above cover the essentials, but they only have value if applied continuously — hence the value of a maintenance contract that handles it. The majority of hacked sites were hacked through negligence, not bad luck.
At Seganiko, security and hardening are part of our maintenance and WordPress development services: managed updates, monitoring, tested backups, firewall, and intervention in case of incident. We also run one-off security audits. The first audit is free.
Need to improve your SEO?
We audit your site and implement a measurable SEO strategy.
See our SEO service →
