Most WordPress security failures start the same way: you log into your dashboard to write a quick update, and there’s a page you didn’t make, selling something you don’t sell, in a language you don’t understand. Nobody broke in dramatically. A bot found the login form and guessed its way in before your coffee finished brewing.
This happens constantly on small business sites, and it’s almost never a targeted attack. It’s the same five WordPress security gaps, over and over.
1. Weak or reused admin passwords
Still the classic. A password guessed, leaked in some unrelated breach, or reused from another account is still the most common way in. A strong, unique password plus two-factor authentication stops most of this before it starts.
2. XML-RPC left switched on
A legacy WordPress API nobody uses anymore, but it’s on by default. One of its methods lets an attacker bundle hundreds of login attempts into a single request, turning slow brute-force into fast brute-force. Turn it off if nothing on the site depends on it.
3. Usernames leaking through the REST API or author archives
WordPress hands out every username for free through its own REST API and ?author=1, no login required. Guessing a password is a lot easier once you already know the username. Neither needs to be public on a typical small business site.
4. Outdated plugins and themes
The moment a plugin vulnerability goes public, automated scanners start checking every WordPress site on the internet for that exact version. A plugin a few months behind isn’t just old, it’s a published entry point.
5. Pirated (“nulled”) themes and plugins
Free downloads of paid themes and plugins from unofficial sources are a well-documented way to install a backdoor before the site even launches. It’s not a bug, it’s the business model. Only source plugins and themes from the official WordPress repository or a legitimate vendor.
Fixing your WordPress security
None of these five are exotic, and together they cause most of the compromises we see. If you’re not sure where your own site stands, that’s exactly the kind of gap we help close as part of managed IT for growing businesses.