“We have a small website—who would even want to target us?”—that’s the most common and costliest mistake. Mass hacking attacks never pick their victims: scanners scan addresses one by one and target those that haven’t been updated. Here’s what to do to avoid getting caught in this scan.
How It Actually Works
The pattern is almost always the same. A public vulnerability report appears for a popular plugin—within hours, automated scanners kick in. They scan millions of websites, checking for one thing: whether a vulnerable version is installed. They didn’t search for your site; they found it through a list.
The second most common cause is password guessing. The bot attempts to log in thousands of times a day from different IP addresses until it guesses the correct password.
10 Steps to Stay Safe
1. Update the core, plugins, and themes
This fixes most of the vulnerabilities. Enable automatic updates, at least for security releases. In the summer of 2026, WordPress released three critical updates in a month and a half— an analysis of exactly what happened.
2. Remove anything unnecessary
An inactive plugin sits on your hard drive and remains vulnerable. The rule is simple: if you’re not using it, delete it—don’t just deactivate it. The same applies to old themes.
3. Long Passwords and Two-Factor Authentication
A password with 16 or more characters in a password manager instead of “Admin2024!”. Two-factor authentication for the admin panel is a plugin that takes just five minutes to install, and it protects you even if your password has already been compromised.
4. Enter your username admin
Half of the bots target this one. Create a new administrator account with a different name, and delete the old one after transferring the content to it.
5. Limit login attempts
A plugin that blocks an IP address after 5–10 failed attempts prevents brute-force password attacks altogether.
6. Disable XML-RPC and the file editor
Almost no one needs XML-RPC, but it’s a convenient way to brute-force passwords and launch denial-of-service attacks. The built-in theme and plugin editor in the admin panel allows code to be executed directly from the browser: if an attacker gains access, they immediately have full control.
The editor closes with a single line in wp-config.php:
define( 'DISALLOW_FILE_EDIT', true );7. File permissions and wp-config.php
Files 644, folders 755, wp-config.php — 600. And here's a special rule: Do not store backups in the website folder. Files such as functions.php.bak or dump.sql The server doesn't execute it but returns it as plain text—anyone who guesses the name can read your code and, in some cases, gain access to the database.
8. Backups that have been tested for restoration
A backup that has never been restored is just a theory, not a backup. Store copies off the website server and try to restore them once a quarter.
9. Access Control
A separate account for everyone who works on the website, with minimal permissions: an editor does not need administrator privileges. When a contractor left, their access was revoked the same day. No shared passwords in the chat.
10. HTTPS and the Latest Version of PHP
The certificate is free today, and browsers flag websites without it as unsafe. Older versions of PHP no longer receive patches: the minimum required version is 8.2–8.3.
How to Tell If a Website Has Been Hacked
- Unwanted links or ads have appeared on the pages, often visible only to search engines;
- Visitors are complaining about being redirected to third-party sites, even though everything opens normally for you;
- Google has flagged the site as unsafe, and traffic has plummeted;
- An unknown administrator has appeared in the list of users;
- The site's folders contain files with random names and recent dates;
- The hosting provider's email service is sending spam, and the domain has been blacklisted.
What to Do If It's Broken
- Make a copy of the website exactly as it is—you'll need it for analysis, even if it's infected.
- Change all your passwords: hosting, FTP, database, admin panel, email. Be sure to do this from a different device.
- Check the list of users and remove any accounts that don't belong to you.
- Restore from a clean backup created before the infection.
- Update everything and patch the vulnerability they exploited—otherwise, they'll hack you again in a few days.
- Request a review in Search Console if Google has already flagged the site.
The worst approach is to simply delete the compromised files and think the problem is solved. The attackers leave several entry points, and the site “comes back to life” a week later.
How much does it cost?
Prevention takes just a few hours of setup and regular updates. Recovering from a breach means losing search rankings, downtime, analyzing infected files, and regaining customer trust. The difference is enormous.
If you don't want to keep track of this yourself—we We provide technical support for websites, including third-party services: updates, verified backups, and monitoring. You can start with an audit—you’ll receive a list of issues with an explanation of what’s critical and what can wait.
Telegram