I run a small WordPress studio — webmaster.co.ua, 18 years, 235+ projects. WordPress's popularity is also why it's the most targeted CMS on the internet. Our first hacked client site taught us more about actual security practice than any checklist ever had.
Most hacks weren't sophisticated — they were unpatched plugins. The incident that changed our process wasn't a targeted attack. It was a known vulnerability in an outdated plugin the client had been running for over a year, because nobody was responsible for updating it. Reviewing our own client base afterward, outdated plugins were the single largest exposure across nearly every site we hadn't put on a maintenance plan.
"We'll update when something breaks" is a security policy, and a bad one. Clients — and honestly, some of our own younger habits — treated updates as optional maintenance, deferred until there was a visible reason to do them. Security patches don't announce themselves. By the time an outdated plugin causes a visible problem, the exposure window has usually already been open for months.
Admin usernames and weak passwords did more damage than any zero-day. A shocking number of the incidents we've cleaned up traced back to "admin" as the username and a password reused from somewhere else, not a novel exploit. Forcing unique credentials and disabling the default "admin" username costs nothing and closes off the most common attack vector we actually see in practice.
Recovery speed depends entirely on decisions made before the incident, not during it. The clients who recovered in an hour were the ones with recent, tested backups and a maintenance plan. The clients who lost days were the ones without either — discovering, mid-crisis, that their "backup" was a stale hosting snapshot from months earlier. Nothing about incident response is fast if the preparation wasn't already done.
We now treat basic hardening as part of every build, not an upsell. Unique admin usernames, login attempt limits, and a security plugin baseline ship by default now, regardless of package tier. It's a small addition to build time that prevents the most common, least sophisticated attacks — the ones that don't need a determined attacker, just an unpatched, unmonitored site.
If your client sites don't have someone actively responsible for updates, that's usually where the real exposure sits — not in some hypothetical sophisticated attack, but in the plugin nobody updated for a year.
Top comments (0)