Is Your WordPress Site a Sitting Duck?

Why outdated WordPress is the problem

WordPress core, and every plugin and theme on top of it, ships security patches regularly. When a vulnerability is fixed, it is also published. That is the right thing to do, but it has a consequence: the moment the fix exists, so does a public description of the weakness, and attackers get it at the same time you do.

From there it is automated. Nobody is researching your business. A bot requests a page, reads what your site says about itself, checks that against a list of published weaknesses, and moves on or does not. An unmaintained site is not being targeted. It is being matched.

What your site is telling the internet right now

A default WordPress install broadcasts more than most owners realise. You can check all of this yourself without any tools beyond a browser:

• The generator tag. Open your homepage, view the page source, and search for generator. On many sites it names WordPress and the exact version.
• The readme file. Visit /readme.html on your own domain. If it loads, it usually states the version in plain text on the first screen.
• The REST API. Visit /wp-json/wp/v2/users. On many installs this lists your admin usernames, which hands an attacker half of a login for free.
• Plugin paths. Search the page source for wp-content/plugins. The folder names tell you which plugins are installed, and the version is often in the file path.

Our tech-stack detector does the first and last of these for you and reports what it finds.

The weak spots that actually get used

• Outdated core or plugins. One of the most common causes of WordPress compromises, and the easiest to fix.
• Abandoned plugins. Installed once for one feature, never updated, and in some cases no longer maintained by anyone. A plugin that has had no update in two years will not be getting a patch when a weakness is found.
• Weak admin logins. A username of admin with a guessable password and no two-factor authentication. Bots try these continuously, and they are patient.
• An exposed login page. /wp-admin and /wp-login.php open to the whole world and brute-forced around the clock.
• No backups. This does not cause a compromise, but it decides whether one is an inconvenience or a catastrophe. Restoring from a clean backup is the difference between a bad afternoon and a rebuild.

What a compromised WordPress site looks like

A modern compromise is quiet, because a defaced homepage gets fixed and a hidden one keeps earning. Owners usually find out indirectly. The signs worth knowing:

• Pages in Google you never wrote. Search site:yourdomain.co.zw and look for results about products you do not sell. This is a common way owners find out.
• Redirects that only happen sometimes. Often only on phones, or only for visitors arriving from a search result, so the site looks fine every time you check it directly.
• Admin users you do not recognise in the users list, or accounts created at hours you were not working.
• Your host emails you about outbound spam or unusual load, which is frequently the first real warning.
• Browser warnings on your own site, or a sudden drop in enquiries with no other explanation.

If you recognise any of these, stop reading this and work through what to do when your website is hacked instead. The order of the steps matters, and taking the site offline before you have preserved anything makes the cause harder to find.

What to do this week

• Update WordPress core, plugins and themes, and delete anything you are not using rather than leaving it deactivated.
• Enforce strong passwords and turn on two-factor authentication for every admin account.
• Remove any account belonging to a developer or staff member who has moved on.
• Add security headers and limit login attempts.
• Set up automatic backups, stored off the server, and restore one once to confirm it actually works.
• Check what version you are broadcasting with our tech-stack detector.

An untested backup is a guess. The restore is the part that matters, and it is worth doing once while nothing is wrong.

What this costs

Most of the list above is free. Updates, deleting unused plugins, removing old accounts, turning on two-factor authentication and limiting login attempts cost you an afternoon and nothing else. Backups are usually a few dollars a month, or free depending on your host.

Paying someone becomes worthwhile in two situations. The first is when a site has fallen far enough behind that updating it breaks things, and somebody has to work out which plugin is the problem. The second is when you want to know what is wrong rather than guess, which is what a penetration test is for. Ours starts at $1,200 and the passive scan is free.

Not sure where you stand?

Most owners genuinely do not know how exposed their WordPress site is, and that is normal. Nobody hands you a report when something falls out of date. Our free website security check answers it without touching your live site, and tells you what to fix first.

If you would rather not deal with it yourself, our penetration testing service finds the rest and we harden it for you. Either way you get the list. What you do with it is your call.