A few weeks back, someone reached out to me in a bit of a panic. Their site was serving pop-up ads to visitors, Google had flagged it with a “this site may be hacked” warning, and their hosting provider had quietly suspended the account. Nothing dramatic had happened on their end — no phishing email clicked, no password shared by accident. The culprit, once I dug in, was a contact-form plugin they’d installed two years earlier and never updated since.
That’s not an unusual story. It’s actually the most common one in WordPress security right now, and it’s worth understanding exactly why before you assume “I’ll get to updates eventually” is a safe bet.
The Uncomfortable Stat: Almost Every Hack Starts With a Plugin
Plugins account for roughly 96–97% of all known WordPress vulnerabilities. Not themes, not WordPress core itself — plugins. And more than 90% of compromised WordPress sites were running at least one outdated plugin at the time of the breach. WordPress core is patched fast and audited constantly; it’s the fifty little add-ons doing everything from contact forms to Instagram feeds that quietly become the weak point.
The scale is bigger than most site owners realize. WordPress still runs more than 40% of the web, which makes it a huge, constant target — sites get probed for known vulnerabilities every half hour or so on average, all day, every day, whether anyone’s looking or not. Small businesses aren’t flying under the radar here either; attackers run automated scans that don’t care how big you are, they care whether you’re running a plugin version with a known hole in it.
Why Plugins Are the Weak Link, Specifically
A few things stack up against you:
Abandoned plugins. A huge chunk of the WordPress plugin directory hasn’t been touched by its developer in over a year. The plugin still works, so nobody notices — until a security researcher finds a hole in it that will never get patched.
Update fatigue. Only a minority of site owners have auto-updates switched on for plugins. Everyone means to check for updates regularly. Almost nobody actually does it every single week, on every single plugin, forever.
Permission overreach. Plugins often ask for far more access than they need for what they do. A slider plugin doesn’t need database-level access, but plenty of them get it anyway because it’s the path of least resistance for the developer.
The Checklist I Actually Run on Client Sites
This isn’t theoretical — it’s the same list I work through for every site I maintain. None of it is exotic; it’s just done consistently, which is the part most people skip.
Updates
Core updated as soon as it’s released, plugins checked weekly, themes monthly. Once a quarter, I audit for anything abandoned — no update in 12+ months is my cutoff for “replace this.”
Access control
No account still using “admin” as its username. Two-factor authentication on every account with publishing or admin rights. Old contractor or past-employee logins get removed, not just deactivated.
Backups
Daily automated backups, stored somewhere other than the same server the site lives on. And this is the step people skip most: actually testing a restore every so often, so you find out a backup is broken before you need it, not during a crisis.
Monitoring and hosting
Weekly malware scans, HTTPS enforced sitewide, login attempts rate-limited, and hosting that’s actually built for WordPress rather than generic shared hosting with no WordPress-specific hardening at all.
What a Hack Actually Costs You
Cleanup after a real compromise typically runs somewhere between $2,500 and $8,000, and that’s before you count the lost bookings, the emails that bounce because your domain got blacklisted, or the week your site sits in “under maintenance” while someone (hopefully not you, at 11pm) figures out what got injected where. Compare that to what a year and a half of proper maintenance costs, and the math isn’t close. I’ve said this before when I wrote about why a professional website still matters in 2026: your site is infrastructure your business depends on, not a one-time purchase you can ignore once it’s live.
The Fix Isn’t “Install One More Security Plugin”
This is where I see well-meaning site owners go sideways. Bolting on a heavyweight security plugin without addressing the actual habits above just adds another piece of software that itself needs updating — and often slows the site down in the process, which creates its own problems. I covered this trade-off in more detail when I wrote about WordPress Core Web Vitals: stacking plugins to solve a problem usually creates a second problem. Security is a routine, not a purchase. One well-configured firewall plus consistent updates and real backups beats five overlapping “security suites” every time.
The Takeaway
If you can’t say with confidence when your plugins were last updated, or whether your backups have ever actually been tested, that’s worth fixing this month — not after something goes wrong. The official WordPress hardening guide is a solid place to see the full technical picture if you want to dig in yourself.
If you’d rather someone else own this checklist so it’s never a fire you have to put out, this is exactly the kind of ongoing care I handle for clients. Get in touch and I’ll take an honest look at your site’s current plugin and update situation.
