WordPress Security Has Changed. Here’s What’s Different

For about ten years the advice for keeping a WordPress site safe didn’t really change. Keep it updated. Use a proper password. Stick a security plugin on. Don’t click the dodgy link. All of that is still true. None of it is enough on its own any more.

WordPress hasn’t got worse. The other side has got better. The way sites get found, poked at and broken into has changed in three specific ways over the last couple of years, and each one eats into the margin for error that most small business sites have been quietly living on.

• Automated vulnerability scanning. Every WordPress site is being probed, catalogued and revisited. Attackers keep a record of what you run and come back when a flaw matches it.
• AI-assisted attacks. Exploits, phishing and break-ins are now written and adapted by machines. Faster, cheaper, more convincing.
• Rapid exploitation. The gap between a flaw going public and mass attacks starting has gone from weeks to hours.

01. Automated vulnerability scanning

The old comfort blanket was “nobody would bother with a site like mine”. Who’s going to go after a six-page site for a plumber in Hertford? Fair question. The answer in 2026 is nobody. A bot will.

Attackers don’t pick targets any more. They run scanners across the whole internet, all day, every day, and fingerprint every WordPress install they touch. Which version. Which theme. Which plugins. Whether any of it has a known hole. Your site isn’t chosen. It’s just on the list with everyone else’s. If you’ve ever looked at a raw server log and wondered why your little site gets a few hundred odd requests a day from countries you’ve never traded with, that’s what you’re looking at.

Here’s the bit most people miss. The scan isn’t the attack. It’s stock-taking. Those requests are building an inventory of your site: WordPress version, theme, every plugin and its version number, what the hosting looks like, whether /wp-login.php and xmlrpc.php answer, which usernames exist. None of that is secret. WordPress hands most of it over by default to anyone who asks nicely. The bots ask, write it down and move on.

Then they come back. Not when you’ve done something wrong. When a vulnerability drops that matches something on your record. Say a flaw gets disclosed in a popular forms plugin. The attacker doesn’t go looking for sites running it. They’ve already got the list, filtered by version, sorted by how easy you looked last time they checked. Your site has been sitting in that database for months waiting for its turn.

That’s the actual shift. It used to be about whether your site was weak right now. Now it’s about whether anything on your inventory ever becomes exploitable, and with thirty or forty plugins on a typical site, something eventually will. The bots don’t forget, they don’t get bored, and they re-scan often enough to notice when you add a new plugin or fall behind on an old one.

So “nobody knows about my site” is finished as a defence. An out-of-date plugin on a site with ten visitors a month gets found and filed just as quickly as one on a site with ten thousand.

You’re not being targeted. You’re being inventoried. The attack comes later.

02. AI-assisted attacks

Scanning builds the list. The second shift is how quickly someone gets through the door once they’re on it. Attack tooling now leans hard on AI. It reads a vulnerability report and spits out a working exploit. It adapts when the first attempt gets blocked. It writes the phishing email that gets your admin login handed over voluntarily.

Two things follow. The bar has dropped: attacks that needed a skilled person now need a prompt. And the quality has gone up. The giveaway spelling mistakes in the fake “your hosting is about to expire” email are gone. Login pages get cloned pixel for pixel. Malicious code tucked into a compromised plugin is written to look boring and legitimate, because boring doesn’t get looked at.

For you as a site owner, the human layer matters more than it ever did. Proper unique passwords, two-factor on every admin account, and a healthy suspicion of anything urgent that lands by email. The automated layers behind that have to assume the attacker is clever, patient and never sleeps.

03. Rapid exploitation

This is the one that kills the monthly maintenance model. When a vulnerability in a popular plugin goes public, the race starts straight away, and because of the first two shifts the attackers now win it in hours, not weeks. The scanners from shift one already know who runs the affected plugin and which version. AI tooling turns the advisory into a working exploit before most people have read the headline. By the time the “please update” email lands in your inbox, the attack is already running at scale.

A recent one. In August 2026 a critical flaw was found in the WPMU DEV Dashboard plugin, which sits on around 350,000 sites. It let anyone on the internet log in as an administrator through the plugin’s single sign-on, no password needed. A patch went out on 24 August. Within two days of the details leaking, attackers were using it in the wild, with automated tooling that probed for the plugin, read off the version number and went straight for the login. Anyone who hadn’t updated by then was handing over admin.

A routine built around “we check for updates once a month” leaves a site open for a fortnight on average after every disclosure. That used to be a risk you could live with. It isn’t now.

The short version: your site is being scanned constantly, by tools that are smarter than they were, and that act within hours of a flaw going public. Any defence that relies on a human noticing in time is already behind.

Why would anyone bother?

This is the bit people genuinely struggle with. “There’s nothing on my site worth stealing.” Usually true. But almost nobody is after your content. They’re after your site: a working server with a clean reputation, a domain Google trusts, and a list of people who trust you. Here’s what hacked WordPress sites actually get used for.

• SEO spam. Thousands of hidden pages selling knock-off trainers, pharmaceuticals or casino sites, injected into your site to borrow its ranking. You don’t see them. Google does. A garden furniture site quietly ranking for a few thousand Japanese product pages is the classic version of this.
• Redirects and malvertising. Your visitors get bounced to scam pages, sometimes only on mobile, sometimes only the second time they visit, so the owner never sees it. The first sign is usually a customer phoning to ask why your site is trying to sell them antivirus.
• Phishing kits. A fake bank or parcel-delivery login hosted in a hidden folder on your domain, because a URL with your business name on it looks a lot more trustworthy than a random one. You find out when your hosting company suspends you.
• Spam relays and botnets. Your server quietly sending tens of thousands of emails a day, or taking part in attacks on other sites. Your domain ends up blacklisted and your own legitimate emails start landing in spam.
• Credential and card harvesting. On WooCommerce sites, a few lines of JavaScript on the checkout skimming card details as they’re typed. Everything still works, orders still go through, nobody notices for months.
• Ransom. Less common on small sites, but it happens: files encrypted or the database wiped, with a note. Usually against sites where the backups turned out not to exist.

None of that needs you to be valuable, it just needs your site to be reachable and running something with a hole in it.

What actually happens when you get hit

The clean-up is the cheap part, the more expensive bit is everything around it.

Google. A “this site may be hacked” warning in search results, or a full red interstitial in Chrome, and your traffic falls off a cliff. Getting the warning removed takes days after the site is actually clean, and rankings can take months to recover, if they recover at all.

Email. If your domain’s been used for spam it’ll be on blacklists, and your quotes and invoices start quietly going to junk. People just think you’ve stopped replying.

Hosting. Most hosts will suspend a compromised site first and ask questions later. Your site is offline until you can prove it’s clean.

Trust and compliance. If customer data was involved you may have an ICO notification to make and some awkward emails to send. Even where it’s “only” a redirect, the customer who got bounced to a scam page doesn’t come back.

Your time. Days of it, at exactly the wrong moment, usually involving a frantic search for a backup that turns out to be from eighteen months ago.

The hack itself is often cleared in an afternoon. The fallout can run for the best part of a year.

Automatic defence

None of this makes WordPress a bad choice. It’s still the right tool for most content-led sites. It does mean the protection around it has to run at the same speed as the threat. Our managed setup is built around exactly that:

• Monitored, prompt patching. Security releases for core, themes and plugins applied as they ship, not on a calendar, with a tested rollback if anything misbehaves.
• Defence in depth. Three overlapping layers, so an attacker who slips past one hits the next: edge filtering, a hardened server, and hardening inside WordPress itself.
• Login hardening. Two-factor, rate limiting and lockouts on every admin account.
• Noise reduction. The thousands of automated probes get blocked before they reach the site, which also happens to make it faster.
• Telling them less. Version numbers, user lists and unused entry points like XML-RPC are hidden or switched off, so the inventory they hold on you is thin and out of date.
• Off-site backups you’ve seen restored. Not just taken.

Want the detail? The security page walks through all three layers and exactly what each one stops.

Five things you can check yourself

You don’t need us for a first look. Pour a coffee, log in, and go through these.

1. Are your plugins up to date? Dashboard, then Updates. If there’s a number in a red circle, that’s your exposure. Pay attention to anything that hasn’t been updated by its author in over a year too. Abandoned plugins never get patched.
2. Is there a security plugin, and is it actually running? Wordfence, Solid Security or similar. Open it. Look at the last scan date. A security plugin installed in 2022 and never opened since is decoration.
3. Any admin accounts you don’t recognise? Users, filter by Administrator. You should be able to name every person on that list. Anything generic like “admin2”, “support” or “wpuser” that you didn’t create is a very bad sign.
4. Any strange files in your directories? Via your host’s file manager or FTP, look in the site root, wp-content and wp-content/uploads. PHP files inside uploads shouldn’t exist. Files with random names, or dates that don’t match the rest, want investigating.
5. What does Google think of you? Search site:yourdomain.com. Every result should be a page you recognise. Pharmacy pages, trainers or casino listings mean you’ve been carrying spam, possibly for months.

Fail any of those and it’s worth a proper conversation. Pass all five and you’re in better shape than most.

Is my site at risk right now?

Possibly. The quickest way to find out is to ask. We’ll take a proper look at how your site is set up and tell you straight where the gaps are and what’s worth fixing, even if the answer is “not much, you’re fine”. Better that conversation than the one that starts with “the site’s gone a bit weird”.