Outdated plugins: the number one way small business websites get hacked
Most hacked small business sites were not targeted. They ran a plugin with a known hole and a script found them. Why plugins are the weak point, and what to do.
Our position, stated plainly
How it actually happens
- A vulnerability is found in a popular plugin and published, often with a fix in a new version.
- Scripts start scanning the web for sites running the vulnerable version, within hours. Not your site specifically; every site.
- Your site is found, because it runs that version and nobody updated it yet, or the update was postponed because the last one broke something.
- The script exploits it: adds an admin user, injects spam links, installs a backdoor, redirects visitors, or quietly harvests form submissions.
- You find out weeks later, from a customer, from a search warning, or from a hosting suspension notice.
Nothing in that sequence involved anyone looking at your business. You were a row in a scan result.
Why plugins are the weak point
| Property of a plugin | Why it matters |
|---|---|
| Third-party code | Written by someone you never met, to a quality you cannot see |
| Runs with full access | Most plugins can read and write everything the site can |
| Public and popular | The same code runs on huge numbers of sites, so a hole is worth finding |
| Maintained on someone else’s schedule | Some are patched in hours; some are abandoned |
| Updates can break things | So businesses postpone them, which is exactly the window attackers use |
| They accumulate | Installed for one feature, forgotten, still running |
What actually reduces the risk
- Fewer plugins. Every one removed is one less thing to scan for. Most sites run several they do not need.
- Automatic updates where the platform supports them, with a staging copy to catch breakage. Manual monthly updates leave days of exposure per incident.
- A routine: someone reviewing the list, the update dates and the scan results every month, in writing.
- A platform where plugins do not run in front of visitors. A static site has no plugin executing on every page load, no public admin and no database reachable from the internet. The attack surface that scripts scan for does not exist.
What this means for you
If your site runs on a plugin stack, the question is not whether it will be scanned; it is whether it will be patched before the scan finds it. Reduce the list, automate the updates, and run scans. If the site is part of how you earn money, the durable answer is a platform where the public site has nothing to scan for, which is how we build them.
Frequently asked questions
We keep our plugins updated. Are we safe?
Safer than most. The window between a vulnerability being published and scripts scanning for it is often hours, so 'updated monthly' still leaves days of exposure per incident. And updates themselves break sites, so many businesses delay them. Keeping the count low and the updates automatic is the sustainable version.
Is this only a WordPress problem?
WordPress has the largest plugin ecosystem, and a larger ecosystem means more extensions that can go wrong. Any platform with third-party extensions running in front of visitors has the same shape of risk: Shopify apps that inject scripts, Joomla and Drupal modules, browser extensions on admin machines. The principle is the same everywhere: every extension is someone else's code with your permissions.
How do I know if a plugin is risky?
Three signs: it has not been updated in a long time, it has few users or reviews, and it does far more than you need it for. A plugin with many users and frequent updates is patched fast when something is found. An abandoned one with a known hole is patched never.
What should we do this week?
List every plugin, remove the ones you do not need, check the last update date of the rest, and turn on automatic updates where the platform allows it. Then run a scan. If the list is long and the site matters to the business, plan a move to a setup where the public site has no plugin stack at all.
Sources
- OWASP Top Ten (accessed 2026-09-11)