Your WordPress site is probably fine right now. That is not the same as secure. Most small business sites run for years without incident, then get compromised in an afternoon by a scanner that never knew your company existed. Here is the honest version: how it happens, what it costs, and what discipline costs monthly.
WordPress Core Is Rarely the Problem, Your Plugins Are
WordPress core is one of the more scrutinised codebases on the web, with a dedicated security team and minor releases that install themselves. Almost every compromise investigation ends up somewhere else: in a plugin or a theme. That is where the code nobody reviewed lives, and where your real attack surface sits.
The architectural detail owners are never told: every active plugin executes with the same privileges as WordPress core. No sandbox, no permission scoping, no capability manifest. A plugin can read and write your whole database, write files to disk and register public routes.
- ▸There is no permission model. A photo gallery plugin has the same access as your payment integration.
- ▸Your risk is the sum, not the average. Twenty-five plugins means twenty-five independent chances of a critical bug, plus twenty-five publisher accounts that can push code onto your server.
That is structurally the same argument we make about npm and PyPI in Supply Chain Attacks: Why Your Dependencies Are Your Biggest Risk. WordPress just has a friendlier install button.
How These Sites Actually Get Compromised
Not by a hacker who targeted you. By automation. A vulnerability is disclosed and patched, the advisory publishes the exact fingerprint, and mass scanners start testing the whole internet for that plugin within hours. Your site is found by pattern matching, never by name.
- ▸Unauthenticated file upload. An endpoint accepts a file without checking who is calling or what it contains. The attacker writes a PHP shell into uploads and runs code as your web server.
- ▸Missing capability checks. A plugin registers an admin AJAX or REST endpoint and forgets the permission callback. Any logged-in user, sometimes any visitor, calls an administrator-only function.
- ▸Privilege escalation. A bug lets a low-privilege account update arbitrary site options, including the default role given at registration. Combine that with open registration, normal on WooCommerce sites, and a stranger becomes an admin.
- ▸Injection. Unsanitised parameters concatenated into queries hand over the users table and password hashes. Untrusted input reaching PHP deserialisation becomes code execution.
- ▸Credential attacks. The login and XML-RPC endpoints are always reachable. XML-RPC historically allows many authentication attempts in one request, making brute force cheap, and WordPress ships no multi-factor login by default.
The window between patch and mass exploitation is now routinely measured in hours. If your update cadence is monthly, you have chosen to be exposed for most of every month.
Abandoned Plugins and Silent Ownership Changes
The plugin working perfectly on your site may have had no maintainer for years. Abandonment is invisible from the dashboard: the code keeps functioning, it just stops receiving fixes. Worse, a popular plugin can quietly change hands, and the new owner inherits push access to your server.
- ▸Abandoned but installed. No update prompt ever appears, so nothing looks wrong. When a vulnerability is found there is nobody to fix it, and removal is the only remedy.
- ▸Sold to a new owner. There are publicly reported cases of plugins changing hands and then shipping injected advertising, tracking or backdoor code. Verify any specific claim against the advisory record, but treat the pattern as real.
- ▸Compromised publisher accounts. The auto-update channel is a code delivery pipeline ending inside your server. Whoever controls the publisher account controls your site at the next update.
- ▸What to do. Keep an inventory with a last-updated date and a named owner per plugin. Anything untouched for a year gets a replacement plan, and anything you cannot justify gets deleted, not deactivated.
Nulled Themes and Ancient PHP: Two Self-Inflicted Wounds
Both are avoidable and we still find them constantly. A nulled theme is commercial code with the licence check stripped out, which means somebody edited it and needs a revenue model. End-of-life PHP is an unpatched interpreter that also blocks every plugin update you need.
- ▸Nulled payloads are predictable. Hidden administrator accounts, obfuscated loaders that pull remote code at runtime, spam links rendered only to crawlers, and card-skimming scripts on checkout pages.
- ▸Nulled infections persist. A dropper in the must-use plugins directory, a modified core file or a rogue scheduled task reinstalls the payload after you think it is clean.
- ▸Old PHP is a doom loop. The interpreter stops receiving security fixes and modern plugin releases refuse to run on it, so you stop updating to keep the site alive and everything freezes at a vulnerable version.
What a Compromise Actually Costs a Small Business
The hosting bill is the smallest line. The real costs are browser and search warnings that stop traffic dead, email deliverability collapse, a rebuild you cannot shortcut, and a data exposure with notification duties attached. Recovery for a small business is typically measured in days of lost trading, not hours.
- ▸Traffic stops. A site serving malware or spam can be flagged by browser safe-browsing systems, and Search Console can issue a manual action for hacked content. Both kill traffic before anyone notices.
- ▸Email dies. If the box relays spam, your sending domain and IP land on blocklists. Invoices, order confirmations and password resets silently stop arriving, and the damage outlasts the cleanup.
- ▸You cannot trust anything on that server. Honest recovery is a rebuild: fresh core and plugins from vendor sources, the database audited for injected content, rogue admins and malicious cron entries, then every credential rotated.
- ▸Regulatory exposure. If personal data was accessible, GDPR breach notification duties may be triggered the moment you become aware, and the deadline is short. Confirm your obligations with counsel now, not during an incident. See How a Single Data Breach Can Kill a Startup (and How to Prevent It) for the wider commercial impact.
Why "We Update It Sometimes" Is Not a Security Posture
Updating when you remember is not a control, it is a habit, and habits fail silently in the month you are busy. A posture has a defined frequency, a named owner, a tested rollback and evidence that it happened. If you cannot produce a log, you do not have one.
- ▸Owner and cadence. One named person or supplier accountable, not the agency who built it in 2019 and stopped replying. A weekly update window on staging first, with critical advisories patched out of band same day.
- ▸Backups you have actually restored. An untested backup is a belief. Keep them off-server and versioned, and restore one quarterly. Attackers target backups first, the same lesson as Ransomware in 2026: What Small Businesses Keep Getting Wrong.
- ▸Identity. Multi-factor on every administrator, no shared logins, and editors who are editors rather than administrators. Most findings in What Security Auditors Find in Almost Every Admin Panel map straight onto WordPress.
- ▸Monitoring and reduction. A vulnerability feed matched to your installed plugin list, file integrity monitoring, and fewer plugins. Every removal is a permanent risk reduction with zero ongoing cost.
What That Discipline Honestly Costs Per Month
Real WordPress maintenance is a recurring line item, not a one-off project. A brochure site typically needs a few hours of skilled attention per month plus hardened hosting. WooCommerce with custom integrations needs materially more, because every update must be tested against code that moves money.
- ▸Hosting. Managed hosting with genuine account isolation, a web application firewall, staging and daily off-server backups. Worth more than any security plugin you can buy.
- ▸Labour. For a brochure site, budget a low three-figure monthly retainer in euro terms. For a transactional store with integrations, expect a mid three-figure to four-figure retainer, because the testing surface is far larger. Rates vary by market, so compare scope, not headline numbers.
- ▸What it must include. Updates on staging, quarterly restore tests, vulnerability monitoring against your plugin list, out-of-band patching, and a written response plan.
- ▸Compare honestly. If you pay for hosting and a plugin bundle but nobody has a calendar entry to apply updates, you are not buying maintenance. You are buying storage.
When Hardening Is the Wrong Answer
WordPress can be run securely, and for content-heavy sites with real editorial workflows it is often the right tool. It becomes the wrong tool when the plugin count keeps climbing, when updates keep breaking production, or when you are already paying for maintenance and still getting compromised.
- ▸Stay and harden if the site is genuinely content-driven, the plugin list is short and maintained, and someone owns it. Cut plugins, fix PHP, enforce multi-factor authentication, and put the cadence into a contract.
- ▸Consider leaving if the site is a brochure held together by a dozen plugins, or if the ongoing security cost exceeds the cost of a purpose-built site with no public admin login and no third-party PHP executing on your server.
- ▸Leaving is not automatically safer. A custom site with a sloppy API and no patching discipline is a different set of holes, the argument in Secure by Design: Why Bolting On Security Later Always Costs More.
- ▸The fear that stops most owners is losing rankings. That risk is manageable with a runbook, set out step by step in Leaving WordPress: A Migration Playbook That Does Not Lose Your SEO.
How TuniCyberLabs Helps
We audit WordPress estates the way an attacker maps them: plugin and theme inventory matched against known vulnerabilities, exposed endpoints, authentication and role hygiene, hosting and PHP posture, backup restorability, and the forgotten staging copies nobody remembers deploying. You get a prioritised findings list with effort estimates and a straight answer on whether hardening or replacement is the better spend. Where replacement wins, our engineers build and migrate it. See our services page.
Book a WordPress security review with TuniCyberLabs and get an honest verdict before an attacker delivers one for free.