What Actually Causes Most WordPress Hacks (Hint: It’s Rarely WordPress Itself)

WordPress itself has a pretty good track record

It’s easy to assume “WordPress got hacked” means WordPress — the core software — had a flaw that let someone in. In practice, that’s rarely what happened. WordPress core has a dedicated security team, a fast turnaround between a problem being found and a fix going out, and automatic background updates for security releases that have been switched on by default since 2013. A huge share of WordPress sites patch themselves for core security issues without the owner doing anything at all.

So where do real breaches actually come from?

Almost always from somewhere else, roughly in this order of how often it shows up:

• Outdated or abandoned plugins and themes. By far the biggest category — more on the distinction below.
• Weak or reused passwords. Still effective for attackers, still common among site owners, which is why automated login attempts never really stop.
• Sloppy hosting setup. Backup files left sitting somewhere public, outdated server software, permissions set too loosely — the kind of thing a decent host should catch but not every host does.

“Outdated” and “abandoned” are not the same problem

An outdated plugin just means an update exists and hasn’t been installed yet — annoying, but fixable in two clicks. An abandoned plugin is a different situation entirely: nobody is maintaining it anymore, which means if a security problem is ever found in it, there’s no fix coming, ever, no matter how long you wait or how many times you check for updates.

This is a genuinely underrated risk, because it hides in plain sight — an abandoned plugin doesn’t announce itself, it just sits there quietly, doing its job, right up until it’s the reason something goes wrong. Before installing any plugin, it’s worth a thirty-second check: when was it last updated, and does it look like anyone’s still actively supporting it? That one habit catches a risk that a security scanner alone often can’t, because an abandoned-but-not-yet-exploited plugin doesn’t look any different from a healthy one until it’s too late.

A simple checklist worth actually following

• Turn on automatic updates for everything that supports it — not just WordPress core, but plugins and your theme too.
• Remove plugins and themes you’re not using. Deactivated isn’t the same as gone — if it’s just sitting in the background unused, delete it.
• Check in every few months on whether anything you’re running has quietly stopped getting updates since you installed it.

What this means in practice

The risk that matters most sits in a layer you can control directly — what you install, how often you update it, and how strong your login credentials are. That’s a different claim from “WordPress is inherently insecure,” and it points at specific, ongoing work rather than a structural flaw nobody can fix: checking plugins before installing them, keeping them updated, and removing what you’re not using.