Most site owners think about website attacks in vague terms. “Hackers.” “Cyberattacks.” “Breaches.” The specifics get lost in the abstraction. Without knowing how attacks actually work, defenses end up generic and gaps remain unnoticed.
The specific attack methods that succeed against websites are well-documented. The patterns are predictable. The defenses are known. Understanding what attackers actually do makes defending much more concrete.
This piece walks through the most common ways sites get hacked, what each attack actually does, and how to defend against it.
Brute Force Attacks on Login Pages
The simplest attack. Try lots of username and password combinations until one works.
How They Work
Automated tools systematically try common username and password combinations against the login page. “admin” with “password123.” Or “admin” with “admin123.” Or thousands of other combinations.
The tools can try hundreds of attempts per minute from each IP address. From botnets with thousands of IPs, they can try many more.
Why They Succeed
Sites with weak admin passwords get cracked. The default WordPress username is “admin” unless changed. Many users pick passwords that are easy to remember (and therefore easy to guess).
If the password is in any database of leaked passwords, automated tools will try it.
How to Defend
Strong unique passwords prevent successful guessing. Two-factor authentication blocks the attack even when the password is correct. Limiting login attempts blocks attackers before they can succeed. Changing the default admin username removes the easy target.
These defenses are cheap and effective. The brute force attack is among the easiest to defend against.
Exploiting Known Vulnerabilities
The next most common attack. Use publicly disclosed vulnerabilities in software to gain access.
How They Work
When a vulnerability is discovered in WordPress, a plugin, or a theme, it gets disclosed publicly. Attackers immediately scan the internet for sites running the vulnerable version. Sites that have not updated get exploited.
The window between vulnerability disclosure and exploitation can be hours.
Why They Succeed
Sites with outdated software are vulnerable. Many sites do not update promptly. Plugin authors sometimes do not release updates quickly. Themes that have been abandoned do not get patched.
The combination produces sites running known-vulnerable software that automated tools target.
How to Defend
Keep all software current. Apply security updates immediately. Use automated updates for minor releases. Test major updates on staging before production.
Remove unused plugins and themes. Less software means fewer potential vulnerabilities.
Use a Web Application Firewall that can virtually patch known vulnerabilities even before you apply the actual patch.
SQL Injection
A more sophisticated attack. Trick the database into running commands it should not.
How They Work
Input fields on a website (login forms, search boxes, contact forms) get sent to the database. If the site does not properly validate the input, attackers can include database commands in the input.
A vulnerable login form might accept “‘ OR ‘1’=’1” as the password, which tricks the database into approving any login.
Why They Succeed
Sites with custom code that does not properly sanitize input are vulnerable. Older plugins and themes sometimes have SQL injection vulnerabilities. New vulnerabilities sometimes get found in established code.
How to Defend
Modern WordPress and most current plugins use prepared statements that prevent SQL injection. Custom code should follow the same pattern.
A WAF can catch SQL injection patterns and block them before they reach the database.
Keep software updated to get fixes for vulnerabilities as they are discovered.
Cross-Site Scripting
Another input-related attack. Inject malicious scripts into web pages.
How They Work
If a site displays user input without proper escaping, attackers can submit input containing JavaScript. When other visitors view the page, the script runs in their browsers.
The script can steal cookies, capture keystrokes, redirect to malicious sites, or do almost anything a normal script can do.
Why They Succeed
Sites that display user-generated content (comments, forum posts, profile information) without proper escaping are vulnerable. The vulnerability shows up in custom code more than in modern WordPress core.
How to Defend
Escape all user input when displaying it. Modern WordPress functions handle this automatically when used correctly.
A WAF can detect XSS patterns and block them.
Content Security Policy headers restrict what scripts can run on your site, limiting the damage even if XSS succeeds.
Credential Stuffing
A specific type of attack using passwords stolen from other sites.
How They Work
When a different site has a data breach, the leaked passwords get traded among attackers. The attackers then try those passwords on other sites.
Many people reuse passwords across sites. The leaked passwords from one site work on others.
Why They Succeed
Password reuse is widespread. Even people who know better sometimes reuse passwords across sites. When one site leaks, all the others using the same passwords become vulnerable.
How to Defend
Strong unique passwords for every site. Password managers make this practical.
Two-factor authentication blocks credential stuffing even when the password is known.
Some sites monitor for credential stuffing patterns and respond by requiring additional verification.
Compromised Plugin or Theme
A different attack vector. Get into sites through trusted software.
How They Work
Attackers compromise the developer of a popular plugin or theme. They insert malicious code into an update. When sites apply the update, they get the malicious code along with the legitimate changes.
This has happened with several popular plugins over the years.
Why They Succeed
Trust in updates. Sites usually apply updates without inspecting them. The malicious code spreads through normal update processes.
How to Defend
Use plugins and themes from reputable sources. Avoid abandoned or rarely-updated software.
Monitor for unusual behavior after updates. Malware scanners often catch the injected code.
For very high-security sites, code review of updates before applying them. This is uncommon but possible.
Phishing Attacks on Administrators
A social engineering attack. Trick the administrator into giving up credentials.
How They Work
Attackers send emails that look like they come from legitimate sources. The emails claim there is an urgent issue and ask the administrator to log in to address it. The login URL goes to a fake site that captures the credentials.
Once the attacker has the credentials, they log into the real site.
Why They Succeed
Even technical people can fall for sophisticated phishing. The fake sites can look identical to real ones. The urgency in the emails creates pressure that bypasses careful thinking.
How to Defend
Two-factor authentication blocks phishing even when credentials are stolen. The attacker needs the second factor to log in.
Train administrators to recognize phishing. Be suspicious of urgent requests. Verify links before clicking. Type URLs directly rather than clicking links in emails.
Use unique passwords managed by a password manager. The manager will not auto-fill credentials on the wrong domain, providing a hint.
File Upload Vulnerabilities
A specific attack that exploits weak file handling.
How They Work
If a site lets users upload files (images, documents, attachments), attackers try to upload malicious files. Sometimes the files are scripts disguised as images. Sometimes they exploit specific vulnerabilities in the upload handling.
Once uploaded, the malicious files can be executed to give the attacker control.
Why They Succeed
Improperly configured upload handling. Validation that checks the file extension but not the actual content. Storage of uploaded files in executable directories.
How to Defend
Strict validation of uploaded files. Check both the extension and the actual content. Restrict allowed file types.
Store uploaded files in directories that cannot execute scripts. Even if a malicious file gets uploaded, it cannot run.
Sanitize file names. Some attacks use special characters in file names to confuse the server.
DDoS Attacks
Not strictly a hack, but a common attack. Overwhelm the site with traffic.
How They Work
Attackers use botnets (networks of compromised devices) to send massive amounts of traffic at the target site. The site cannot handle the load and goes offline.
This does not involve breaking into the site. Just making it unavailable.
Why They Succeed
Sites without protection cannot handle traffic floods. The infrastructure gets overwhelmed.
How to Defend
DDoS protection services like Cloudflare absorb the traffic before it reaches your site. The protection scales to handle traffic floods that would overwhelm your hosting.
Earlier piece in this series covered DDoS protection in detail.
Drive-By Downloads on Visitor Browsers
A less common but serious attack. Use the site to compromise visitors.
How They Work
The attacker compromises a site. They inject code that exploits vulnerabilities in visitor browsers. Visitors who land on the site get their computers infected.
The site owner often does not realize this is happening because the site appears normal.
Why They Succeed
The injected code is invisible to normal browsing. It only triggers exploits when conditions are right. Visitors may be infected without any visible sign.
How to Defend
Strong security on the site prevents the initial compromise that enables this.
Active malware scanning catches infected code on the site.
Content Security Policy restricts what scripts can load on your site.
Recognizing You Have Been Hacked
Sometimes attacks succeed. Recognizing the signs matters.
Signs of Compromise
Unexpected files or directories on the server. Unfamiliar admin accounts. Slowdowns. Unexpected outgoing traffic. Sudden ranking drops. Customer reports of strange behavior. Browser warnings about malware. Blacklists flagging the site.
What to Do First
If you suspect a hack, treat it as confirmed until proven otherwise.
Take the site offline if possible. This stops the damage from spreading.
Change all passwords immediately. Hosting, admin, FTP, database, anything.
Contact your host. They can help with investigation and may need to act if their other customers are affected.
Run malware scans. Identify what was installed and where.
Recovery
For most hacks, recovery involves restoring from a clean backup, updating all software, changing all credentials, and adding the security layers that would have prevented the breach.
For complex or persistent compromises, professional security help may be needed.
Notification
Depending on what was accessed, you may have notification obligations to customers, regulators, or partners. Consult legal counsel if customer data may have been exposed.
Closing the Threats Picture
Understanding common attacks turns abstract security concerns into concrete defenses. Each attack method has specific defenses. The defenses are usually not expensive or difficult, just disciplined.
For most sites, the right approach is to defend against all the common attacks systematically. Strong passwords and 2FA against brute force. Current software against known vulnerabilities. Input validation and WAF against injection attacks. Backups against any successful attack.
The defenses overlap. Many of them help against multiple attack types. A WAF blocks brute force, injection, and many vulnerability exploits. 2FA blocks brute force and credential stuffing. Backups help with recovery from anything.
Sites without these defenses are easy targets. Sites with them rarely have successful attacks. The attackers move on to easier targets. The math favors investing in defense.
The investment in understanding attacks is small. The investment in defending against them is modest. The investment in recovering from a successful attack is large. The trade-off is overwhelming in favor of prevention. Sites that take attacks seriously and defend against the common methods stay safe. Sites that ignore the threats eventually get attacked successfully. The choice is not really between secure and insecure. It is between proactive defense and reactive recovery. Defense costs less and is much less painful. Pick that side of the trade.
