Why WordPress has a reputation for being hacked
WordPress runs roughly four in ten websites, so it is the biggest target, and a large share of those sites are set up once and never touched again. Attackers run automated scans for known holes in old plugin versions and try the same few passwords on every login page they find. When a site that has not been updated in two years gets hacked, the headline says 'WordPress site hacked', but the cause was neglect that would have sunk any platform.
How WordPress sites actually get compromised
- Outdated plugins and themes with published vulnerabilities. By far the most common cause.
- Weak or reused passwords on admin accounts, with no two-factor authentication and the default 'admin' username.
- Nulled (pirated) premium themes and plugins, which routinely ship with malware.
- Poor hosting where one hacked site on a shared server infects its neighbours.
- Abandoned plugins that no longer receive patches but stay installed.
The WordPress security threats page describes each of these in detail and what the fix looks like.
What a secure WordPress setup looks like
Updates applied within days of release; a strong, unique password and two-factor authentication on every admin account; a limited number of well-chosen, maintained plugins; a managed host or a firewall in front of the site; daily off-site backups with a tested restore; HTTPS; and someone who checks on all of this. That is the bulk of what a maintenance plan is. If the site is already compromised, how to tell whether your website has been hacked lists the signs, and WordPress fixes covers the clean-up.