The most common question we get after a website incident is “why would anyone target us?” Almost always, nobody did. Automated software scans the whole internet looking for known weaknesses, and it does not care whether you are a bank or a bakery. Security firm Sucuri puts it plainly in its threat report: “Attackers often use automated scripts and tools to scan the internet for susceptible sites.”
That is good news, because defending against automation is far more achievable than defending against a determined human.
Where does the real risk come from?
Out-of-date plugins and themes
When a plugin vulnerability is published, attacks often start within hours, not weeks. Patchstack’s State of WordPress Security in 2026 found that 91% of new WordPress vulnerabilities were in plugins, and that about half of the high-impact ones were exploited within 24 hours. The gap between “fix released” and “fix applied” is where most break-ins happen.
Reused and shared passwords
If a password used on your website also appears in a breach of some unrelated service, it will be tried on your login. Verizon’s 2026 Data Breach Investigations Report still finds stolen credentials and unpatched vulnerabilities behind most basic web application attacks. Shared logins make this worse, because nobody can tell you who still knows the password.
Accounts nobody removed
The developer from four years ago, the intern, the agency you stopped working with. Every unused administrator account is a door left unlocked.
Too many plugins
Every plugin is code somebody else maintains, or stops maintaining: Patchstack found 46% of vulnerabilities had no fix from the developer by the time they were made public. The fastest security improvement most sites can make is deleting the six plugins nobody uses, which is WordPress’s own advice too.
What actually reduces the risk?
- Keep things updated, and check after. The update itself is easy. Noticing that it broke the booking form is the valuable part.
- Give people the least access they need. Most people who edit content do not need to be administrators.
- Turn on two-factor authentication for every account that can change the site. The U.S. Cybersecurity and Infrastructure Security Agency says using MFA makes you 99% less likely to be hacked.
- Remove accounts the day someone leaves, including ours if you ever stop working with us.
- Keep backups you have tested, kept far enough back that you can escape a problem you did not notice immediately.
- Fewer moving parts. Delete unused plugins, themes and integrations.
What matters less than people think?
Hiding your login URL, renaming the admin account, and similar tricks are often sold as security. They add small friction for automated scanners and considerable friction for you. They are not a substitute for updates, access control and backups.
Likewise, no host, plugin or agency can promise you will never be targeted. Anyone who does is selling certainty that does not exist. What can be promised is that somebody notices quickly and knows what to do next.
What should you do if something happens?
- Do not delete anything yet — a copy of the compromised site is how you work out what happened.
- Restore a clean backup from before the problem.
- Change every password and revoke every session and application password.
- Work out how it got in, and close that specific gap.
- Check whether anything else shares those credentials, especially email.
The step most people skip is the fourth. A restore without a diagnosis means the same door is still open.
We wrote up how we handle this on hosted sites on our website security page, and our hosting and ongoing care plans include it. If you are not sure who still has access to your own site, that is a good afternoon’s work, and we are happy to help with it. A free website check-up is an easy place to start. Domain names get targeted too; here is how to spot a domain renewal scam.
