How Often Do WordPress Sites Get Hacked?

Roughly 13,000 WordPress sites are hacked every day. That number is not an estimate of targeted attacks. It is an estimate of successful compromises detected across the global install base.

That works out to about 9 sites per minute. These are real sites belonging to real businesses and individuals who mostly had no idea they were at risk.

What do these numbers actually mean?

In 2025, researchers logged 11,334 new WordPress security holes. That is a 42 percent increase from the year before. Ninety-one percent of those vulnerabilities came from plugins.

When a new vulnerability is published, automated scanners update within hours and begin probing sites. A site running a plugin with a known vulnerability is a target the moment that vulnerability is public.

The math for a site with 20 to 30 plugins is worth considering. Each plugin has its own history and future of vulnerabilities. Over the course of a year, a typical small business site runs through many plugin updates, some triggered by security issues. Each one represents a window: the time between the vulnerability being public and the update being applied.

Attackers work in that window. Exploits often launch within hours of a vulnerability going public.

Does a small site get targeted?

Yes. This is a common misconception worth correcting.

Attacks on WordPress sites are almost entirely automated. Bots scan millions of URLs looking for specific signatures: known vulnerable plugin versions, unprotected login pages, accessible configuration files. They do not read your site or care what it is about.

A small florist’s website is exactly as likely to be scanned as a large e-commerce operation. If the florist’s site is running a plugin with a known vulnerability, the automated scanner finds it and flags it for exploitation.

The attacker is not after your business data. They want your server resources: computing power for spam campaigns, a trusted domain for phishing, storage for files, or traffic to redirect to other sites.

What do the numbers look like over time?

In 2025, 11,334 new WordPress vulnerabilities were logged. In 2024, the number was about 32 percent lower. The trend is going in the wrong direction.

This is partly because the plugin ecosystem keeps growing. More plugins means more code, and more code means more vulnerabilities to find. Security research has also improved: researchers are finding issues more systematically than they did five years ago.

The practical effect is that the maintenance burden on WordPress site owners grows each year. More patches to apply, more alerts to review, more exposure windows to manage.

What you can do today

1. Audit how many plugins you are running. Each one is a potential entry point.
2. Check that everything is current. Outdated plugins with known vulnerabilities are the most common entry point for automated attacks.
3. Remove plugins you do not actively use. An inactive plugin is still running code.
4. Set up vulnerability monitoring so you hear about new holes quickly.
5. Check your site against the symptoms in how to tell if your site has been hacked.

Why this keeps happening

The volume of hacked sites is not random variance. It is a predictable output of a system where new vulnerabilities appear constantly and millions of sites do not update quickly enough to beat the exploit window.

This is structural. Updating diligently helps. It does not eliminate the problem, because new vulnerabilities will appear in your plugins tomorrow and next month and next year.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free. A site with no plugins has no plugin vulnerabilities and is not in the pool of 13,000 sites that get hit each day.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.