The typical WordPress site that gets hacked is not the victim of an advanced, targeted attack. It is usually something far more mundane: a plugin with a known security hole that nobody updated, a login with a weak or reused password, or a site that simply has not been looked after in a long time. Protection is therefore less about expensive security products and more about routine: controlled updates, monitoring, backups that can actually be restored, and a person or supplier who is explicitly responsible.
What the threats actually are
Vulnerable plugins and themes
Every plugin is code from an outside vendor, and many business sites run dozens of them. When a security hole is discovered, it is published together with a fix. From that moment, automated tools start scanning the web for sites still running the vulnerable version. Sites that update within a few days are usually fine; sites that wait for months are easy targets. Plugins that are no longer maintained are a particular risk, because no fixes will ever arrive.
Weak logins
Bots try to log in to WordPress sites around the clock. Reused passwords, shared admin accounts and old accounts belonging to former employees or previous agencies are common ways in. Two-factor authentication, meaning a one-time code on your phone in addition to the password, effectively stops this kind of attempt.
Outdated sites
It is not only about plugins. WordPress itself, the theme and PHP – the programming language WordPress runs on, provided by your hosting company – all need to stay current. A PHP version that has reached end of life receives no security fixes at all.
What is new in 2026
Attackers increasingly use automation and AI to find vulnerable sites and write convincing phishing emails. That does not change what protects you, but the time between a vulnerability becoming known and being exploited has become shorter. There have also been cases where a plugin itself was hijacked, so that a malicious version was distributed as a regular update. The best defence is to run few plugins, from vendors who actively maintain them.
What neglect costs
A breach is rarely noticed straight away. Typical consequences are hidden spam pages and links that drag down your Google rankings, visitors being redirected to scam sites, warnings in search results, and the hosting company suspending the account. If customer data has leaked, it may be a personal data breach that under GDPR must be reported to the data protection authority (in Sweden, IMY) within 72 hours. In an online store, the payment step can be tampered with.
The clean-up itself is often the smallest problem. Lost sales, lost rankings, time spent working out what happened and customer trust weigh more. Without a clean backup, the site may need to be rebuilt. Compare that with ongoing care: maintenance plans from Swedish agencies that publish their prices range from roughly SEK 400 to 5,000 per month, depending on the size of the site and what is included.
Why updates matter – and why they sometimes go wrong
Updates contain security fixes, bug fixes and compatibility with newer PHP versions, so skipping them is not an option. At the same time, updating is not risk-free: one plugin can clash with another, a theme can stop working with a new WordPress version, and a store's checkout can stop accepting payments. That is why many site owners postpone updates, and that is how sites become vulnerable.
The answer is to update often, but in a controlled way:
- Take a backup before anything is updated.
- Test updates on a copy of the site (a so-called staging environment) before they go out to the live site.
- Afterwards, check the flows that bring in money: forms, checkout and login.
- Prioritise fixes for security holes that are already being exploited. Those should go in within days, not at the next scheduled update.
Automatic updates can work for a simple brochure site. For online stores and sites with integrations, you want more control, and someone who can step in quickly if an update breaks something.
What should be in place
- An update routine with testing on a copy and a clear plan for urgent security updates.
- Backups stored somewhere other than the hosting account, where restoring has actually been tested.
- Personal logins with two-factor authentication for everyone with admin rights, and old accounts removed.
- Few, well-maintained plugins. Anything unused is deleted, not just deactivated.
- A current PHP version at your hosting company.
- Monitoring of known vulnerabilities in the specific plugins you use, and uptime monitoring that alerts someone if the site goes down or changes.
- A web application firewall (WAF), a filter that blocks known malicious traffic before it reaches the site. It is often offered by the hosting company or as a service in front of the site.
- A simple incident plan: who you call, where the backup is and who contacts customers or authorities if needed.
Who is responsible?
The most common gap is organisational rather than technical. The agency that built the site delivered it and moved on, the hosting company assumes the customer handles WordPress, and the marketing team thinks IT does. Responsibility usually breaks down like this:
- The hosting company is responsible for the server and often for basic backups of the account. It is not responsible for your plugins, your theme or your user accounts.
- You or your supplier are responsible for WordPress, plugins, theme, users and content.
- Your company is always the data controller for the customer data the site collects.
Ask for a written answer to three questions: who updates the site and how often, where are the backups, and who restores the site if something happens on a Friday evening.
How to tell it is being handled
- You receive a short monthly report on what was updated, any incidents and the status of backups.
- Your supplier can tell you when a restore was last tested.
- When you log in, there are no updates that have been waiting for weeks and no admin accounts you do not recognise.
- External monitoring alerts someone other than you. We built Ravnsight ourselves for monitoring and diagnosing websites.
Our recommendation
Treat WordPress security as ongoing maintenance, not a one-off project or a product you buy. If you have the skills and time in-house, you can run the routines above yourselves. If you do not, handing responsibility to a supplier is usually cheaper than dealing with a breach. Our WordPress maintenance plan includes tested updates, security monitoring, uptime monitoring and backups with tested restores for a fixed monthly fee. We are happy to go through where your site stands today.