The WordPress Security Gaps We Keep Finding in Client Audits

When a client comes to us after a WordPress site has been compromised, or before they sign on to one of our maintenance plans, we run a full audit first. The plugin stack changes from client to client. The industry changes. The hosting provider changes. But the actual gaps we find are almost always the same handful of things, repeated across hundreds of sites.

None of these are exotic. None require a nation-state attacker. They are the boring, structural gaps that make a site an easy target instead of a hard one, and every one of them is fixable in an afternoon.

Delayed updates hand attackers a public roadmap

When a plugin developer patches a vulnerability, the changelog and the CVE disclosure usually go public within days, sometimes hours. That is not a leak, it is how responsible disclosure works. But it also means every unpatched install on the internet just became a documented, searchable target. Automated scanners crawl for exactly this: version numbers that match a known CVE. “I’ll update it tomorrow” is the single most common reason we see sites compromised, because tomorrow is usually too late.

The login layer is still the weakest point

Default “admin” usernames, memorable passwords, and no two-factor authentication turn wp-login.php into an open door. We still see it constantly: reused passwords, no login attempt limiting, no 2FA. Brute-force bots do not need to be clever if the front door is not locked.

Pirated plugins are a backdoor by design, not by accident

“Nulled” premium plugins and themes are not just missing a licence check, they have usually been modified to include a backdoor before being redistributed. Anyone installing a cracked plugin to save fifty dollars a year is handing an unknown third party direct access to their site. We treat any site running nulled software as compromised until proven otherwise.

Budget hosting undermines every other control you put in place

Shared, unmanaged hosting at a few dollars a month usually means no WAF, no malware scanning, and no isolation between your site and every other tenant on that server. You can lock down your own WordPress install perfectly and still get compromised through a neighbouring account on the same box. Hosting is a security layer, not just a place to serve files from.

Access that is broader than it needs to be

Every user account with Administrator access is a full attack surface: their email, their password habits, and their own device security all become part of your site’s risk profile. The principle of least privilege applies here directly. Editors do not need admin, contractors do not need standing access after the project ends, and old freelancer accounts should be removed, not just disabled.

File permissions nobody has checked since launch

World-writable directories and overly permissive file permissions are one of the easiest ways for a single compromised plugin to escalate into a full site takeover. This is invisible from the WordPress dashboard, which is exactly why it gets skipped, but it is a five-minute fix during any proper server-level audit.

A backup policy nobody has actually tested

Having backups is not the same as having a recovery plan. We regularly find sites with backups that silently failed for months, or that only exist on the same server they are meant to protect against. A backup you have not test-restored is a backup you do not actually have.

What this means in practice

None of this requires an enterprise budget. It requires someone actually checking, on a schedule, rather than assuming the last person to touch the site did. That is the entire premise behind how we have engineered Cloudflare into every managed WordPress site: WAF rules, Imunify360 malware scanning, and CloudLinux isolation catching these gaps automatically, so they do not get the chance to sit unnoticed for months. If you want to see how it holds up under a real incident, our Stealth Files series walks through an actual recovery. For the full picture of our approach, see our managed WordPress plans.