Key Takeaways
- In 2025, over 11,000 new vulnerabilities were identified in the WordPress ecosystem — a 42% increase over the previous year. (Patchstack)
- In October 2025 alone, nearly 1,000 plugins were pulled from the WordPress repository due to security flaws — those plugins had 7.1 million combined active installations.
- Only 26% of vulnerability attacks are blocked at the hosting and server layer. The rest depend on your site being kept up to date.
- The average cost of a successful cyberattack on a business is $4.45 million in downtime, lost revenue, and recovery.
- Most WordPress hacks are preventable. Outdated plugins, weak passwords, and no SSL are responsible for the majority of breaches.
When did you last check your website security?
If your answer is “I’m not sure” or “I assumed my host handles that” — this guide is for you. Website security is not a one-time setup task. It requires regular attention, and in 2026, the consequences of neglecting it are more severe and more expensive than ever.
The good news: most attacks are preventable. And for businesses on a professional maintenance plan, most of this happens automatically in the background. Here is what you need to know.
Why WordPress Sites Are Targeted
WordPress powers 43% of the internet. That ubiquity makes it the most profitable target for cybercriminals in the world. Attackers do not need to develop unique exploits for thousands of different platforms — they can write one attack that works across millions of WordPress sites simultaneously.
The attack surface is significant:
- Plugins and themes introduce the majority of vulnerabilities — over 90% of WordPress security issues originate from third-party plugins and themes, not WordPress core itself
- Shared hosting environments mean a compromised neighbouring site can sometimes affect yours
- Automated scanning tools allow attackers to probe millions of sites per hour looking for known vulnerabilities
- AI-driven attack tools in 2026 can identify and exploit vulnerabilities faster than ever — sometimes within hours of a new exploit being publicly disclosed
This is not cause for panic. It is cause for a consistent, maintained security posture.
The Threat Landscape in 2026
The numbers from Patchstack’s State of WordPress Security report for 2026 are sobering:
- 11,334 new vulnerabilities were identified across the WordPress ecosystem in 2025 — a 42% increase over 2024 (Patchstack)
- Only 26% of vulnerability attacks are blocked at the hosting and server layer — the rest require your plugins and themes to be patched
- 1,000 plugins were removed from the WordPress repository in October 2025 alone due to unpatched security vulnerabilities, with 7.1 million combined active installations
- Attackers weaponise new vulnerabilities within hours of public disclosure — the window between a patch being released and an attack being launched is shrinking rapidly
The old model of “update plugins once a month” is no longer adequate. Active monitoring and rapid patching are now the baseline standard for any site that matters to your business.
What Does a Hacked Website Actually Cost?
Business owners often underestimate the real cost of a security breach because they think about it in terms of the ransom or cleanup fee. The actual cost is much broader:
- Downtime revenue loss — every hour your site is offline or serving malicious content is a direct revenue loss
- Google blacklisting — Google actively flags hacked sites in search results with “This site may harm your computer” warnings, destroying organic traffic immediately
- SEO damage — rankings built over months or years can be devastated in days if a hacked site is penalised or deindexed
- Data breach liability — if customer data is compromised, your POPIA obligations are triggered, including mandatory notification to the Information Regulator and affected individuals
- Recovery costs — professional malware removal, site rebuilding, and security hardening after the fact costs significantly more than proactive maintenance would have
- Reputation damage — clients and prospects who encounter a hacked or defaced version of your site do not forget it easily
The average cost of a successful cyberattack on a business in 2025 was $4.45 million. For small businesses without enterprise security infrastructure, a successful breach can be existential.
How Often Should You Check Your Website Security?
The honest answer: certain checks should happen automatically every day, while others make sense weekly, monthly, and quarterly. Here is a practical schedule:
Daily (Automated)
These should run automatically via your security plugin and hosting setup — you should not be doing these manually:
- Malware scanning — automated scan for known malware signatures and injected code
- Uptime monitoring — alert immediately if your site goes offline
- Failed login attempt logging — flag brute-force attacks in progress
- Firewall activity review — monitor blocked threats and unusual traffic patterns
- Automated offsite backups — daily snapshot stored separately from your server
Weekly
- Plugin and theme update review — apply available security patches promptly
- WordPress core update check — core security releases should be applied as soon as they are available
- User account review — check for any unfamiliar administrator accounts
- Review security plugin alerts and logs for anything requiring attention
Monthly
- Full security audit of installed plugins — remove anything unused, abandoned, or without recent updates
- Password audit — ensure all admin accounts use strong, unique passwords and two-factor authentication
- Backup restore test — confirm your backups actually work by testing a restore in a staging environment
- SSL certificate validity check — expired SSL certificates cause browser warnings that kill visitor trust instantly
- Review Google Search Console for any security warnings or manual actions
Quarterly
- Full penetration check — use a tool like WPScan or a professional audit to probe for known vulnerabilities
- Hosting security review — confirm your hosting environment is on current PHP versions and hardened server configuration
- Access and permission review — audit which users have what access, remove former employees or contractors
- Database security check — review for unused tables and excessive admin accounts in the database
Annually
- Full security architecture review — is your current setup still appropriate for your site’s size, traffic, and risk profile?
- Disaster recovery test — simulate a full breach scenario and confirm your recovery process works end-to-end
- Third-party service audit — review all connected services, APIs, and integrations for security and continued necessity
The Website Security Checklist: What Your Site Needs Right Now
If you have never done a formal security review on your WordPress site, start here:
SSL Certificate
Your site must run on HTTPS — not HTTP. If your browser shows a padlock next to your URL, your SSL is active. If it shows “Not Secure,” this is the first thing to fix. An SSL certificate encrypts data between your visitor’s browser and your server. It is also a Google ranking factor and a POPIA compliance requirement for any site collecting personal information.
WordPress Core, Theme, and Plugin Updates
Log into your WordPress dashboard and check for available updates. Any outdated component is a potential vulnerability. Apply all updates — but back up first in case an update causes a compatibility issue.
Remove Unused Plugins and Themes
Every installed plugin — even deactivated ones — is code sitting on your server that can be exploited. Delete anything you are not actively using. This reduces your attack surface immediately.
Strong Admin Credentials
Change your WordPress admin username from “admin” (the default, and the first thing attackers try). Use a strong, unique password of at least 16 characters. Enable two-factor authentication on all admin accounts.
Security Plugin
Install a reputable WordPress security plugin. Wordfence, Solid Security (formerly iThemes Security), and Sucuri are all well-regarded options that provide firewall protection, malware scanning, login attempt limiting, and alerting.
Limit Login Attempts
By default, WordPress allows unlimited login attempts. This makes brute-force attacks trivial. Your security plugin should limit failed attempts and temporarily block IP addresses that exceed the threshold.
Offsite Backups
Your hosting provider’s backup is not sufficient on its own. If your server is compromised, those backups may be compromised too. Use an offsite backup service (like UpdraftPlus connected to Google Drive or Dropbox) so you always have a clean copy you can restore from.
Change the Default Database Prefix
WordPress installs use “wp_” as the default database table prefix. Attackers know this and target it in SQL injection attacks. A non-standard prefix makes these attacks significantly less effective.
Disable File Editing from the Dashboard
WordPress includes a built-in editor that allows code changes directly from the dashboard. If an attacker gains admin access, this is an immediate exploit vector. Disable it by adding define('DISALLOW_FILE_EDIT', true); to your wp-config.php file.
Warning Signs Your Site May Already Be Compromised
Not all hacks are immediately obvious. Watch for these indicators:
- Unexpected redirects — visitors land on your site and are redirected to unfamiliar pages
- Google warnings — a “This site may be hacked” or “Deceptive site ahead” message in search results or the browser
- Unusual admin accounts — unfamiliar users in your WordPress user list, especially with administrator access
- Unexpected content — new pages, posts, or links that you did not create
- Performance degradation — sudden slowdowns caused by your server being used to send spam or mine cryptocurrency
- Google Search Console alerts — security notifications in your GSC dashboard
- Hosting suspension — your host suspends your account for distributing malware or spam
If you spot any of these, take your site offline or put it in maintenance mode immediately and contact a professional for remediation. Do not attempt to clean an actively compromised site while it is live.
What to Do If Your Site Gets Hacked
Step 1: Take the site offline or restrict access immediately to prevent further damage and stop the spread of malicious code.
Step 2: Restore from a clean backup if you have one from before the breach. This is the fastest path to recovery.
Step 3: Engage a professional for malware removal if you do not have a clean backup or are unsure of the extent of the compromise. Manual cleanup of an infected WordPress installation requires expertise.
Step 4: Identify and close the entry point — whether an outdated plugin, compromised credentials, or server vulnerability — before going back online.
Step 5: Change all credentials — WordPress admin passwords, hosting passwords, FTP/SFTP credentials, and database passwords.
Step 6: Request a Google review via Google Search Console to have any security warnings removed from search results once the site is clean.
Step 7: Assess your POPIA obligations — if customer data was accessible during the breach, you may have a mandatory reporting obligation to the Information Regulator of South Africa.
How Sarlie Digital’s Maintenance Plan Handles This
If your WordPress or WooCommerce site is on a Sarlie Digital maintenance plan, the daily, weekly, and monthly security tasks in this guide happen automatically — without you having to think about them.
What our maintenance plans include:
- Automated daily offsite backups with tested restore capability
- WordPress core, plugin, and theme updates applied on a scheduled basis
- Security plugin monitoring with active firewall and malware scanning
- Uptime monitoring with immediate alerts
- SSL certificate monitoring and renewal management
- Monthly security reports
- Priority response if a security incident occurs
The goal of a maintenance plan is simple: you should never have to think about whether your site is secure. We take care of it so you can take care of your business.
Frequently Asked Questions
Final Thoughts
Website security is not a problem you solve once. It is an ongoing discipline — one that gets easier and more cost-effective when it is handled proactively rather than reactively.
The statistics from 2025 and 2026 make clear that the threat environment is intensifying, not easing. AI-driven attacks, faster exploit weaponisation, and a growing volume of WordPress vulnerabilities mean that “set and forget” is not a viable security strategy for any site that matters to your business.
If you are managing your own WordPress security and want a professional review, or if you are tired of worrying about whether your site is protected, get in touch with us for a general discussion, or request a quote to discuss a maintenance plan tailored to your site.
