WordPress Security: Common Vulnerabilities and How to Harden Your Site

WordPress powers a large share of the web, including many company marketing sites that sit on the same domain as the product. The WordPress core is well maintained. Most compromises come from what is added on top.

Why WordPress sites get hacked

Vulnerable plugins and themes

The majority of WordPress vulnerabilities are in plugins and themes, not core. Common issues include unauthenticated file uploads, SQL injection, stored XSS, privilege escalation and missing authorisation on AJAX or REST actions. Abandoned plugins never receive fixes.

Outdated software

Sites that are not updated stay vulnerable to issues with public exploits. Automated bots scan for specific plugin versions within hours of a vulnerability being published.

Weak or reused admin passwords

Brute force and credential stuffing against wp-login.php and XML-RPC are constant.

Nulled themes and plugins

Pirated premium plugins frequently contain backdoors.

Poor hosting configuration

Writable core files, exposed backups, wp-config.php copies and directory listing.

What attackers do with a hacked WordPress site

• Inject spam links and pages, damaging your search rankings.
• Redirect visitors to scams or malware.
• Host phishing pages on your domain.
• Steal customer data from forms and e-commerce.
• Use the server to attack others.
• Pivot to other systems sharing credentials or hosting.

Hardening checklist

1. Update core, plugins and themes promptly. Enable automatic updates for minor releases and trusted plugins.
2. Remove unused plugins and themes, including inactive ones.
3. Choose plugins carefully: actively maintained, widely used, recently updated.
4. Enforce strong passwords and MFA for all admin accounts.
5. Limit login attempts and consider restricting /wp-admin by IP or SSO.
6. Disable XML-RPC if you do not need it.
7. Disable file editing in the dashboard with define('DISALLOW_FILE_EDIT', true);.
8. Use least-privilege roles; not everyone needs Administrator.
9. Protect wp-config.php, and keep backups out of the web root.
10. Disable directory listing and PHP execution in the uploads directory.
11. Use a web application firewall, at the host or CDN level.
12. Back up regularly, off-site, and test restores.
13. Use HTTPS and security headers.
14. Monitor file changes and admin logins.

Separate your marketing site from your app

If your WordPress site lives on www.example.com and your app on app.example.com, make sure a WordPress compromise cannot reach the app: separate hosting, no shared credentials, and cookies not scoped to the parent domain.

If your site is hacked

1. Take it offline or into maintenance mode.
2. Restore from a known-clean backup, or rebuild.
3. Update everything and remove the vulnerable component.
4. Rotate all passwords, keys and salts.
5. Check for backdoors and new admin users.
6. Request a review from search engines if your site was flagged.

Testing your WordPress site

SecurityInfinity detects WordPress installations across your subdomains, identifies plugin and theme versions, matches them to known CVEs, and checks for exposed files and weak configurations. Start free.

Frequently asked questions

Is WordPress insecure?

The core is generally secure when updated. Risk comes mainly from plugins, themes, weak passwords and outdated installations.

Do security plugins make WordPress secure?

They help with monitoring, firewalling and hardening, but cannot replace updates, careful plugin choice and strong authentication.

How often should WordPress be updated?

Apply security updates as soon as they are available, and review all updates at least weekly.