Most WordPress sites don’t get hacked by some exotic, never-seen-before exploit. They get hacked through a handful of predictable doors that are left open on millions of sites. Here are the five we see most often as penetration testers — and what actually closes them.
1. Vulnerable plugins and themes
The single biggest cause. A plugin ships a bug, a fix is released, and attackers immediately scan the whole internet for sites that haven’t updated yet. The window between disclosure and mass exploitation is often hours. Keep everything updated, remove plugins you don’t use, and run a firewall that blocks the technique (SQL injection, file inclusion) so you’re covered even before you patch.
2. Weak or reused admin passwords
Automated bots hammer wp-login.php with lists of leaked passwords all day long. If one admin reuses a password that’s already in a breach dump, it’s game over. Use long unique passwords, and add a second factor so a stolen password alone isn’t enough.
3. Brute-force login attempts
Even without a leaked password, bots will guess. Without a lockout, they get unlimited attempts. Rate-limit failed logins per IP so repeated guessing is shut down after a few tries.
4. An over-exposed attack surface
XML-RPC, user enumeration, the file editor, directory listings — features most sites never use but that hand attackers free reconnaissance and extra ways in. Turning them off removes whole categories of attack in one go.
5. Backdoors left behind
Once in, attackers drop hidden PHP files so they can return even after you patch the original hole. This is why cleaning a hacked site means hunting every backdoor, not just fixing the entry point — and why an integrity scanner that flags unexpected file changes is worth running continuously.
None of these require a genius attacker. They’re opportunistic, automated, and entirely preventable with a few sensible defaults — which is exactly what DefendMyWP ships with.
