WordPress Under Attack: 12 Real Threats and How to Defend Against Them

Introduction#

WordPress powers over 40% of the web, making it a lucrative target for hackers. While it’s secure out of the box, vulnerabilities often arise from outdated plugins, misconfigurations, and weak hosting environments. In this guide, we’ll explore the top WordPress attacks in 2025 and share a practical hardening recipe—including modern defenses beyond your server.

1. Brute Force Login Attacks#

Hackers use automated bots to try thousands of username and password combinations targeting /wp-login.php or xmlrpc.php. Think of it like someone standing at your door with a robot trying every possible key.

Mitigations:

• Enable 2FA using plugins like WP 2FA or Wordfence
• Rename or protect the login URL with WPS Hide Login
• Limit login attempts via Limit Login Attempts Reloaded
• Block XML-RPC unless required:

  1
  add_filter('xmlrpc_enabled', '__return_false');
  

2. SQL Injection (SQLi)#

Hackers trick your website into running unwanted database commands by injecting malicious code into input fields. If your site doesn’t sanitize inputs, that code could actually run.

Mitigations:

• Use well-maintained plugins/themes only
• Use prepared statements in any custom code
• Enable WAF rules (e.g., Cloudflare’s managed ruleset)

3. Cross-Site Scripting (XSS)#

Attackers inject harmful JavaScript into parts of your site—like blog comments. When other users view that page, the code runs in their browsers, stealing login cookies or redirecting to scam sites.

Mitigations:

• Validate and sanitize all user inputs
• Use plugins that escape output properly
• Set Content Security Policy (CSP) headers
• Use Wordfence or similar scanners

4. Cross-Site Request Forgery (CSRF)#

This attack tricks logged-in users into performing actions they didn’t intend—like changing their password or deleting content—just by visiting a malicious website while still logged into yours.

Mitigations:

• Use nonces in form actions
• Verify HTTP referrer and origin headers
• Keep plugins/themes updated

5. File Inclusion Vulnerabilities#

Hackers try to load and run unauthorized files on your server—often through plugins that allow uploading or referencing external files. It’s like giving someone permission to upload a file and they sneak in a virus instead.

Mitigations:

• Disable allow_url_include and allow_url_fopen in php.ini
• Avoid untrusted plugins
• Disable dangerous PHP functions:

  1
  disable_functions = exec,passthru,shell_exec,system
  

6. Malware Injection#

Hackers sneak malicious code into your site through vulnerable plugins or weak passwords—creating hidden backdoors, redirecting visitors, or adding hidden admin accounts.

Mitigations:

• Scan with Wordfence, Sucuri, or MalCare
• Disable file editing:

  1
  define('DISALLOW_FILE_EDIT', true);
  

• Enforce strong file permissions:

  1
  find . -type f -exec chmod 644 {} \;
  2
  find . -type d -exec chmod 755 {} \;
  

7. Outdated Plugins & Themes#

Plugins and themes that aren’t updated have known vulnerabilities. Hackers scan the internet looking for sites running old versions. It’s like leaving your windows open because you forgot to upgrade to shatterproof glass.

Mitigations:

• Use auto-updates or ManageWP for central management
• Remove unused plugins/themes
• Use only actively maintained plugins from trusted sources

8. Privilege Escalation#

Attackers find a way to increase their access level—starting as a basic subscriber but tricking the system into making them an admin. Like sneaking past the front desk and ending up with the building master keys.

Mitigations:

• Audit roles and capabilities regularly
• Use User Role Editor to lock permissions
• Restrict admin access by IP if possible

9. Directory Traversal#

This attack tricks your website into exposing sensitive files by manipulating file paths (like ../../wp-config.php).

Mitigations:

• Nginx/AWS WAF rules to block patterns like ../
• Sanitize input on all custom file functions
• Use ModSecurity or Cloudflare custom rules

10. REST API Abuse#

The WordPress REST API, if not properly protected, lets attackers gather usernames, modify content, or flood your site with fake data. It’s like an open window with no screen.

Mitigations:

• Limit API access using the Disable REST API plugin
• Block unauthenticated endpoints unless explicitly needed

11. Spam & Comment Injection#

Bots flood your comment sections or contact forms with malicious links, harming your SEO and potentially getting your site flagged by search engines.

Mitigations:

• Use Akismet Anti-Spam
• Enable CAPTCHA with reCAPTCHA by BestWebSoft
• Disable comments if unused, or require admin review before publishing

12. Search Engine Poisoning#

Attackers quietly insert hidden links or redirects to gambling, adult, or scam websites to hijack your SEO traffic or damage your credibility.

Mitigations:

• Monitor file changes regularly
• Scan for hidden JavaScript or <a> tags in posts/pages
• Use Google Search Console and security plugins

Server-Side Hardening#

1
server_tokens off;
2

3
location ~* /(xmlrpc\.php|readme\.html|license\.txt) {
4
    deny all;
5
}
6

7
location = /wp-config.php {
8
    deny all;
9
}

1
expose_php = Off
2
display_errors = Off
3
log_errors = On

Network-Level Protection with Cloudflare#

• DDoS protection
• WAF with WordPress-specific rulesets
• Bot management using reCaptcha
• Rate limiting for login pages
• Automatic HTTPS with HSTS
• Page Rules to protect /wp-login.php, /xmlrpc.php, and wp-admin

Bonus Hardening Tips#

• Use a Web Application Firewall (Cloudflare, Sucuri, or Wordfence Premium)
• Enable automatic backups to remote object storage for files and database dumps
• Enable two-factor authentication for all admins—Wordfence is a great starting point
• Enforce SSL everywhere
• Use WPScan, MalCare, or Jetpack Protect for regular audits

Notable Real-World WordPress Breaches#

Conclusion#

WordPress security in 2025 isn’t just about firewalls or hiding login pages. It’s a layered defense strategy—covering application, server, and network levels. With smart hardening and tools like Cloudflare, you can protect your site from even the most sophisticated attacks.