Has your site ever been flagged by Google for malware? Or logged into your dashboard one morning to find admin accounts you never created?

That happened to me in 2026. A plugin I had installed years earlier had a known vulnerability — the patch was available, I kept dismissing the update notification, and a bot found the hole before I got around to it. The site was silently injecting spam links into every post footer for weeks before Google Search Console finally flagged it. Cleaning it up took two full days.

Eight years running WordPress sites taught me that security is not about being paranoid. It is about understanding where attacks actually come from and closing the right doors. Most WordPress hacks are not sophisticated. They are automated and opportunistic, run by bots that do not care who you are.

Why WordPress Is a Constant Attack Target

WordPress powers approximately 43% of all websites on the internet. That scale is the entire explanation for why it gets attacked so relentlessly. Attackers do not need to target your specific site — they run automated scanners across millions of domains simultaneously, fingerprinting software versions and matching them against databases of known exploits.

When a new CVE gets published for a popular plugin, working exploits often appear within hours. The window between a vulnerability being disclosed and bots actively scanning for it has shrunk to under 24 hours in most documented cases from 2026 through 2026.

Where WordPress Vulnerabilities Actually Come From

According to Patchstack’s 2026 WordPress Vulnerability Report, plugins account for 97% of all discovered WordPress vulnerabilities. Themes are a distant second. WordPress core is rarely the attack surface — the core team is large, well-resourced, and ships security patches fast.

The real risk is the plugin you installed in 2019 for a feature you rarely use, maintained by a solo developer who has not pushed an update in over a year. That is the open door. Not your password, not your hosting account — the dormant plugin sitting quietly in your wp-content/plugins folder.

What Attackers Actually Want From Your Site

Most attackers targeting WordPress are not after your personal data. They want server resources to mine cryptocurrency or run spam campaigns. They want your domain authority — SEO spam links injected into your content that quietly boost their own sites in search rankings. They want to redirect your visitors to phishing pages, or add your server to a botnet used for attacks on other targets.

Understanding this reframes your strategy entirely. You are not protecting classified information. You are making your site a harder target than the next domain in the scan queue. Most bots move on when they hit basic resistance.

The Shared Hosting Problem

Shared hosting is where most WordPress security stories go sideways. On a poorly-configured shared server, a compromise on one account can spread to neighboring accounts through weak file permission isolation. Before committing to any shared hosting plan, ask the host specifically whether they run PHP-level account isolation. That single question tells you a lot about how seriously they approach tenant security.

Seven Attack Methods You Need to Defend Against

These are the real attack vectors, ranked roughly by frequency based on WordPress security incident reports:

1. Brute force login attacks — automated password guessing at /wp-login.php. Cheap to run at scale and effective against weak or reused passwords. Some botnets run simultaneous attempts across thousands of sites at once.
2. Outdated plugin exploits — the most common vector by far. A known, unpatched plugin vulnerability is an advertised open door. Bots detect plugin versions from page source code and cross-reference CVE databases automatically.
3. SQL injection — malicious database queries sneaked through vulnerable input fields like contact forms or search boxes. Common in older plugins that fail to sanitize user input before passing it to the database.
4. Cross-site scripting (XSS) — attackers inject JavaScript into your site output that then runs in your visitors’ browsers. Used to steal session cookies, redirect users to malware pages, or display convincing fake login prompts.
5. File inclusion exploits — PHP attacks where the server gets tricked into loading and executing arbitrary files, either sensitive local files or remotely hosted malicious code.
6. XML-RPC abuse — a legacy WordPress API endpoint enabled by default on every installation. A single XML-RPC request can test hundreds of username and password combinations in one hit, making login lockout thresholds much harder to enforce effectively.
7. Supply chain attacks — a legitimate plugin gets abandoned, purchased by an attacker, and updated with malware that pushes to every site running it. The AccessPress Themes incident in 2026 compromised over 40 themes and plugins. Rare, but the blast radius when it happens is enormous.

The first six are preventable with standard hardening. Number seven requires staying current on WordPress security news — following Patchstack’s alerts or the Wordfence blog gives early warnings when a trusted plugin gets flagged.

Security Plugins Compared: What Each One Actually Does

No plugin prevents every attack. The right one monitors, alerts, and blocks the majority of automated threats before they cause real damage. Here is how the main options stack up:

My pick for a personal blog: Wordfence free. The 30-day firewall rule delay compared to the premium tier is a real tradeoff, but acceptable for a low-traffic site. If you are running a business site or handling payments, Sucuri’s $199/year WAF operates at the DNS level and blocks attacks before they ever reach your server. That is not just a feature upgrade — it is a fundamentally different model of protection.

One hard rule: do not run two security plugins simultaneously. They conflict, double-scan, and have been known to lock site owners out of their own dashboards. Pick one, configure it properly, and leave it alone.

Hardening Steps That Take Less Than an Hour

Installing a security plugin and walking away is the most common mistake I see. The plugin monitors and filters. You still have to lock the actual doors yourself.

Move and Lock Down Your Login Page

Your WordPress login lives at /wp-login.php by default. Every bot scanner on the internet knows this address. The free WPS Hide Login plugin moves it to any custom URL you choose in under two minutes. Once relocated, the bulk of automated brute force traffic disappears because bots cannot find the door in the first place.

Enable two-factor authentication. Wordfence includes TOTP-based 2FA in the free tier. The standalone WP 2FA plugin by Melapress works equally well with Google Authenticator or Authy. Use app-based TOTP — not email-based 2FA. If your email account is ever compromised, email 2FA provides zero additional protection.

Set a login attempt limit. Three failed attempts triggering a 20-minute lockout is a reasonable starting point. Wordfence handles this automatically once you enable brute force protection in the configuration panel.

Disable XML-RPC Unless You Are Actively Using It

XML-RPC is a legacy WordPress API built for remote publishing from desktop applications. Almost nobody uses it anymore — the REST API replaced it years ago. Adding a deny rule for xmlrpc.php in your .htaccess file eliminates this entire attack surface. If editing server files makes you uncomfortable, the free Disable XML-RPC plugin achieves the same result in one click.

This single change stops XML-RPC brute force amplification attacks completely. High value, minimal effort. Do it today.

Update Within 72 Hours of Any Security Patch

The gap between a vulnerability being disclosed and bots actively scanning for it has compressed to under 24 hours in recent documented cases. I run automatic updates for most plugins and themes, with one exception: complex plugins like WooCommerce get tested against a staging environment first because a bad update on a checkout page is its own kind of incident.

Sign up for Patchstack (free community tier) or WPVulnerability.net for email alerts when plugins you are actively running have new CVEs. Getting notified within hours of a patch dropping is the difference between proactive hardening and reactive fire-fighting.

Backups Are Your Actual Last Line of Defense

No firewall recovers a deleted database. No malware scanner rebuilds corrupted core files. A clean backup from yesterday does both.

UpdraftPlus free tier, configured to back up daily to Google Drive or Dropbox with off-server storage, is the non-negotiable baseline every WordPress site should have. The $70/year premium version adds incremental backups and cleaner one-click restoration. Jetpack Backup at $9.95/month is simpler to restore from the dashboard but costs more annually. Either works — what does not work is a backup stored only on your own server, which gets wiped in the same attack that compromises the site.

When DIY Security Is the Wrong Call

DIY security makes sense for personal blogs and early-stage sites. It stops making sense the moment you are collecting payments, storing user data, or have meaningful revenue depending on uptime. At that point, managed WordPress hosting is not a premium upgrade — it is often cheaper than recovering from a single incident.

What does managed WordPress hosting actually include?

Kinsta ($35/month entry tier), WP Engine ($25/month), and Flywheel ($15/month) all include server-level firewalls, automated malware scanning, nightly off-site backups, and emergency hack cleanup in their base plans. They run accounts in isolated containers — a compromise on another customer’s site on the same physical server cannot touch yours.

The economics are straightforward. A post-hack professional cleanup through Sucuri’s incident response service or WP Buffs starts at $200 to $500 for a basic site. One incident covers two years of managed hosting fees. Add lost search traffic, Google manual action penalties, and the hours you spend in recovery mode, and the managed hosting case becomes even harder to argue against.

How do you check if your site is already compromised?

Run Sucuri’s free SiteCheck scanner — it scans your site externally and flags known malware signatures without needing admin access. Check Google Search Console under the Security and Manual Actions section for anything flagged. Look through your Users list for admin accounts you did not create. Unexplained outbound links embedded in your post content or footer, especially pointing to unrelated domains, are a strong indicator of active SEO spam injection already in progress.

What is the minimum viable setup for a simple personal blog?

Wordfence free with brute force protection and 2FA configured. UpdraftPlus free backing up daily to Google Drive. A non-obvious admin username combined with a 20-character password from a password manager. Automatic plugin updates enabled across the board.

That entire setup costs nothing and closes the doors on the vast majority of attack vectors targeting small WordPress sites. Stop there. Four security plugins and a $50/month security subscription for a site with 5,000 monthly visitors is security theater, not security.

For a monetized site or anything with real business stakes: move to Kinsta or WP Engine, let the managed infrastructure carry the weight, and put your energy into the work that actually moves the site forward. The monthly hosting cost is real — and it is still cheaper than learning what a PHP backdoor looks like at 2am on a Saturday.