How Hackers Get Into WordPress Sites

WordPress sites are usually broken into through an ordinary mistake, not a novel attack. Outdated plugins, a reused password, a nulled theme, a shared host with weak separation, or a leaked SFTP login are the doors this guide covers. Each section says what that door looks like and the specific steps that close it. Nothing here explains how to break in.

How does an outdated plugin or theme become a door?

WordPress core, plugins, and themes are public software. When a vendor fixes a security bug, the old release is a known door. The site does not have to be famous. The same flaw can be tried against every site that still runs it.

The version is often public. The generator tag and the ?ver= query on CSS and JavaScript tell a visitor what you run. Hiding those strings is optional. Installing the update is the control. The WordPress vulnerability checker explains what that version string means and what it does not prove.

Close it like this. Take a backup you can restore. Update core from the dashboard or with the current package from WordPress.org. Update every plugin and theme from its vendor, not from a zip a stranger sent. Delete plugins and themes you are not using, including inactive ones. If a product is abandoned, remove it and replace the feature. If the site is already hacked, update during the cleanup, after a backup, not instead of finding extra users and files that do not belong.

How do reused passwords get a site taken over?

WordPress will accept the right password forever, from anywhere, unless you add another check. People reuse the wp-admin password on email, on the host, and on other websites. When any of those is leaked, the password is no longer a secret. Attackers try known username-and-password pairs against wp-login. They do not need a software bug.

Close it like this. Use a different long password for every WordPress administrator, the database, the hosting panel, SFTP, and the registrar. Keep them in a password manager, not in a file on the server and not in an email draft. Turn on two-factor authentication for administrators, the host, and the registrar. Remove accounts for former staff and old contractors. Revoke application passwords and API keys you cannot match to a current tool.

If you suspect the password is already in someone else's hands, changing it is not the whole job. A file already planted on the server will still be there after the password changes. Clean the files, then rotate the secrets. The order is in How to clean a hacked WordPress site.

Why are nulled themes and plugins a door?

"Nulled" means someone removed the license check from a paid theme or plugin and passed the files along. The copy is pirated, and the packager can add anything else to it before you install it. The extra code does not need a vulnerability in WordPress. You installed it yourself, often as an administrator, which is the highest privilege on the site.

There is no checklist that makes a nulled zip safe. Comparing it with a clean mind is not a comparison. You need the vendor's original file for that, and if you can get the vendor's file you do not need the nulled one.

Close it like this. Delete the nulled theme or plugin. Install a fresh copy from the seller, or choose a different product and configure that instead. Rotate WordPress salts and administrator passwords after it is gone, because the package may have already seen them. Check the user list and the uploads directory for accounts and PHP files you did not add. Do not download a "cleaned" copy from the same place that offered the nulled one.

How does insecure shared hosting let someone in?

On shared hosting, many customers sit on one machine. A careful host walls those accounts off. A careless one lets a neighbor read your files or write into a shared temporary directory, so their hack becomes your files. You can do everything right in wp-admin and still inherit a compromise from the server.

You usually learn this from the host, not from WordPress. The symptom is often a suspension for malware, or files reappearing after you delete them, or a hack that returns with no new plugin and no new user. Read hosting suspended for malware before you buy another year of the same plan out of panic.

Close it like this. Ask the host, in writing, whether another account could write into yours. Take their backup, then clean the site. Do not upload that infected tree to a second account. Prefer a host that isolates accounts. Use a unique database password, remove old sites on the same account, and do not leave backup zips in a public folder. If cleaned files reappear and the host cannot explain it, move and deploy the cleaned copy only.

How does leaked SFTP or SSH access work as a door?

SFTP and SSH are the logins that upload files. They sit beside WordPress, not inside it. A password in an old email, a laptop you sold, a freelancer's notes, or a breach of a different service is enough. An SSH public key left in the account keeps working after you change the password, if you do not remove the key.

Someone with that login can place a file, change a theme, and read wp-config.php, which holds the database password. They never need to see wp-login. Locking down the WordPress form does not close this door.

Close it like this. From the hosting panel, set a new SFTP or SSH password that you have never used anywhere else. Open the list of SSH keys and delete every key you do not recognize. If the host offers IP restrictions for SFTP and your own IP is stable, restrict it. If several people upload files, give them separate users and remove those users when the project ends. Do not send the SFTP password in email or chat. After a leak, inspect the site as a cleanup, not as a password change only. Look for unknown administrators and for PHP files in uploads, which are described in unknown administrator and strange PHP files in uploads.

What does not belong on this page?

This is not a list of payloads, and it is not a set of steps for trying these doors against a site you do not own. If your own site already shows spam, a redirect, or a warning, the repair order is the cleanup guide, not a second tour of the door. A free read-only scan can show public signs. It cannot prove which door was used.

Site URL Scan my site free

Read-only scan · No install · Results in about 30 seconds

Emergency Cleanup is $499 when you want that repair done for you, with a written report of the cause we can support. Protection is only for a site that is clean. An already-infected site has to be cleaned first. That is a requirement, not an upsell tucked into checkout.

Fix it now — $499 Talk to us by email