How Hosted Sites Get Hacked (And How to Reduce the Risk)

Most hosted sites don't get hacked through the host's servers — they get hacked through the site itself: weak or reused passwords, out-of-date software, vulnerable plugins and themes, and phishing. That's the encouraging part, because those are things you control. Host-level breaches do happen and are worth understanding, but they're the exception. Knowing where break-ins actually start lets you spend your effort where it pays off, and a short, boring checklist prevents the large majority of real-world compromises.

Outdated software: the number-one cause

The most common way a site is compromised is a known vulnerability in outdated software — usually a CMS, plugin or theme that hasn't been updated. When a security flaw is disclosed and patched, attackers immediately scan the web for sites still running the old version, because the exploit is public and the targets are easy. On WordPress in particular, vulnerable and abandoned plugins are a leading entry point. Keeping everything updated, and removing plugins and themes you don't use, closes this door — and it's the single highest-impact thing you can do. Automatic updates for security releases are worth enabling for exactly this reason.

Weak, reused and stolen passwords

The second big category is credentials. Attackers run automated brute-force and credential-stuffing attacks, trying common passwords and username/password pairs leaked from other sites' breaches. If you reuse a password that appeared in any leak, or use something guessable, your admin login is exposed no matter how good the host is. The fixes are cheap and decisive: a password manager so every login is long, random and unique, and two-factor authentication so a stolen password alone isn't enough to get in. Turn on 2FA for your CMS admin and your hosting control panel especially, because the control panel is a master key to everything.

Phishing and social engineering

Sometimes attackers skip the technology and target you. A convincing email that looks like it's from your host, asking you to "verify your account" on a fake login page, can hand over your credentials directly. Others impersonate support to talk you into a password reset. The defence is habit: never log in via a link in an unexpected email — go to the host's site directly — and treat urgency and threats as red flags. Two-factor authentication also blunts phishing, because a stolen password without the second factor is far less useful. Your host secures its servers; only you can avoid typing your password into a lookalike site.

When the host itself is breached

Host-level breaches are rarer, but they're real and worth understanding because they're the part you can't patch yourself. A well-documented example: GoDaddy disclosed in November 2021 that attackers had accessed its Managed WordPress provisioning system, affecting up to 1.2 million customers and exposing email addresses, some admin passwords, and in some cases SSL private keys. In February 2023, GoDaddy further disclosed in a US securities filing a multi-year intrusion, dating back to 2020, in which attackers installed malware and redirected some customer sites. These are cited not to single out one host — breaches have hit others too — but to make a point: choosing a reputable host with a solid security track record matters, and because even good hosts can be breached, your own off-host backups are part of the defence, not a nicety.

The uncomfortable truth is that most hacks are preventable with unglamorous hygiene: update your software, use a password manager and 2FA, and keep your own backups. Attackers rely on people not doing the boring things.

The short list that prevents most break-ins

Reduce your risk dramatically with a handful of habits: keep your CMS, plugins and themes updated and remove what you don't use; use a password manager and unique passwords; turn on two-factor authentication everywhere, especially your hosting panel; limit admin access to people who need it; and keep your own off-host backups so you can recover fast. Pick a host that isolates accounts, scans for malware and patches promptly to cover its half. The full, ordered version is the hosting hardening checklist, and the host side is scored in our most secure web hosting ranking.

Your own devices and accounts are part of the attack surface

Break-ins don't only come through the server or the login page — sometimes they come through you. Malware on your own laptop can steal saved passwords, including FTP credentials stored in a desktop client, which has been a real infection vector for years. A malicious browser extension can read what you type into your admin panel. Logging into your site over untrusted public Wi-Fi without HTTPS everywhere can expose credentials in transit. And if your email account is taken over, an attacker can trigger password resets for your host and CMS and walk in the front door. Securing your site therefore includes securing the devices and accounts you manage it from: keep your computer patched and malware-free, use two-factor authentication on your email, and be wary of the browser extensions you install.

Don't install nulled or pirated plugins and themes

One avoidable way people get hacked is installing 'nulled' — pirated — premium plugins and themes from unofficial sites. These are frequently bundled with backdoors and malware precisely because they're attractive free downloads, and installing one hands an attacker access from day one, with no vulnerability required. The same caution applies to abandoned free plugins from unknown authors. Install only from official sources — the CMS's own directory or the developer's site — keep the number of extensions small, and prefer ones that are actively maintained. Free is not worth a backdoor, and a single malicious plugin can quietly undo every other precaution on this list.