Why Does WordPress Get Hacked So Much?

WordPress sites get hacked so often because the attack surface is enormous. It is not the core software that causes most breaches. It is the plugin ecosystem, and that problem is structural.

Roughly 13,000 WordPress sites are hacked every day. In 2025, researchers logged 11,334 new WordPress security holes. Ninety-one percent of those came from plugins. This is not bad luck. It is math.

Why does every WordPress site have so many plugins?

WordPress is a platform, not a finished product. To add a contact form, you install a plugin. To improve your SEO, you install a plugin. To speed up images, handle backups, block spam, or run a store, you install more plugins.

The average small business WordPress site runs between 20 and 30 plugins. Each one is code written by a different team. Each one has its own update schedule, its own security track record, and its own vulnerabilities waiting to be found.

Think of it this way: WordPress is a house with a hundred doors and windows. Every plugin adds another door. Keeping the front door locked does not help if one of the back doors has a broken latch. Attackers do not try one door. They try them all, automatically, around the clock.

How do attackers find the holes so fast?

They do not look manually. They run automated scanners that check millions of sites a day. When a new vulnerability is published, the scanner is updated within hours. Your site gets checked whether you know about the problem or not.

In 2025, researchers logged 11,334 new WordPress security holes. That is an average of 31 new vulnerabilities every single day. Even a diligent owner who checks the news and applies updates the same day faces a window of exposure.

Exploits often launch within hours of a vulnerability going public. Patches take longer to write, test, and release. That gap is when sites get hit.

Is this anyone’s fault?

No. This is not a failure of your web developer or your hosting company. It is the structural result of how the ecosystem works. Tens of thousands of plugins exist. They are built by individuals, small teams, and large companies. Quality and response times vary widely.

The WordPress core team is serious and responsive. But they do not control every plugin. They cannot. That is part of what makes WordPress powerful and part of what makes it hard to keep secure at scale.

What you can do today

1. Find out how many plugins your site is running. Log into your dashboard and count them.
2. Check when each plugin was last updated. Anything not updated in over a year is a risk.
3. Remove any plugin you are not actively using. Inactive plugins still run and still have vulnerabilities.
4. Turn on automatic updates for plugins, themes, and WordPress core.
5. Set up a vulnerability notification service so you hear about new holes before attackers exploit them.

Why this keeps happening

The updates help. They are genuinely worth doing. But they solve yesterday’s problem. Tomorrow a new hole will be found in one of your other plugins. The month after, another one.

This is not a maintenance failure. This is the design. A site with plugins will always have a plugin attack surface. Staying ahead of it is a full-time job that most small business owners never signed up for.

Basalt moves small business websites off WordPress to a platform with nothing to hack and nothing to update. The move is free. If you want to understand the scope of the problem on your specific site, the next section can help.

Find out what is wrong in 60 seconds

Or skip all this. Enter your web address and we will tell you exactly what is wrong with your site. Free, 60 seconds, no account needed.