Most sites are not breached by someone targeting them. They are breached because an automated scanner found a known vulnerability in a plugin that has not been updated in two years. That means prevention is both possible and cheap.
The four most common causes
- An outdated plugin or theme. The leading cause by a wide margin. Vulnerabilities are published when they are patched, which turns the patch note into a roadmap for anyone who has not applied it.
- Shared or weak passwords. One admin account used by three people cannot be traced and cannot be revoked when someone leaves.
- No two-factor authentication on the admin panel, the hosting account or the domain registrar.
- Permissions wider than the job. A content editor does not need the ability to install plugins.
A backup you have never restored is not a backup
Most businesses have backups. Very few have ever restored one. An untested backup is a hypothesis, and you may discover it was incomplete at the worst possible moment.
The practical rule: keep a copy off the same server, and do a full restore test at least once a year with a documented result.
The domain account is the one that matters most
Whoever controls the domain controls the site. If your domain is registered under a developer's name or a former employee's email, you do not own your own digital asset. Check today, then enable transfer lock and two-factor on the registrar account.
The checklist for this week
- Update everything, then open the site and confirm it still works.
- Delete deactivated plugins. Deactivated code is still exploitable.
- Enable two-factor on the admin panel, hosting and registrar.
- Review the user list and remove anyone who has left.
- Restore a backup to a staging environment and confirm it is complete.
If it does happen
Do not delete the evidence first. Isolate the site, change passwords from a clean device, preserve server logs, then restore from a backup confirmed to predate the compromise. Restoring from an infected backup is the most common mistake and brings the problem straight back within days.
Frequently asked questions
Is an SSL certificate enough?
No. A certificate encrypts traffic between browser and server. It does nothing about a compromised plugin or a leaked password. It is a baseline requirement, not a security strategy.
Is WordPress insecure?
Updated WordPress is not. Abandoned WordPress with three-year-old plugins is, and that describes the majority of installations rather than a rare exception.
