How Many WordPress Websites Are Hacked?

WordPress is the most popular blogging platform currently available. It is extremely popular because it is simple to use and it provides bloggers with a free option that allows them to create a professional-looking blog in no time at all. Because of its popularity, it is not a great surprise that cybercriminals have started targeting it, too. In this article, we will discuss how many WordPress websites are actually being hacked, and why.

Why Are Cybercriminals Targeting WordPress?

If you’re running a WordPress website and you’re not sure why cybercriminals are targeting you, here’s a simple explanation. WordPress is extremely popular, and there are a lot of vulnerable websites using it. Because these websites are so popular, cybercriminals know that they can easily make money from them by infecting them with malware and stealing their users’ personal data.

In some cases, cybercriminals might even take over the site altogether and make a lot of money from it. In other cases, they might hack into administrative accounts and steal important information which they can use to further compromise other websites using WordPress, or infect other users with ransomware and extort money from them.

How Many Times Have Sites Using WordPress Been Hacked?

It’s important to note here that not all hacked WordPress sites are created equal. Some hackers have gotten really, really good at compromising websites, and they’ve managed to compromise a lot of highly-trafficked blogging platforms and content management systems. They might even go as far as compromising WordPress’ core files and hacking the source code itself, leaving behind a backdoor, or exposing customer information.

Based on cybersecurity firm Net-Security’s analysis of 7 million hacked websites, we know that WordPress has been hacked at least 500,000 times in the last year alone. That’s an astonishing number of attacks, and it even exceeds the popularity of the platform itself. It’s pretty clear that WordPress is the cyberattack target of choice.

What’s The Most Popular Way To Hijack A Site Using WordPress?

Taking over a site using WordPress is a bit like taking over a website in general. There are several ways to accomplish this. The two most popular ways, according to Net-Security, are via SQL injection and via brute force. Let’s take a closer look at each one.

SQL Injection

SQL injection is a kind of attack that allows an intruder to modify the way a database looks to the end user. In simpler terms, it’s when a hacker manages to trick a website user into executing malicious code on the website by using SQL statements in a question mark place instead of a curly brace place in an SQL query. For instance, if a website user were to execute the following SQL query:

• SELECT * FROM {$wpdb->prefix}posts WHERE 1=1 AND {$wpdb->prefix}posts.post_status = ‘publish’
• SELECT * FROM {$wpdb->prefix}comments WHERE 1=1
• SELECT * FROM {$wpdb->prefix}posts WHERE 1=1 AND {$wpdb->prefix}posts.post_status = ‘draft’

It is absolutely vital that you learn how to protect yourself from SQL injection attacks. The second you learn about SQL injection, you can start seeing attacks everywhere.

There are several ways to protect yourself from SQL injection. One way is to carefully auditing all of the applications that you install on your server. Another way is to use a security plugin that scans for suspicious SQL code and stops it before it can do any damage. Yet another way is to use a virtual private network (VPN) to log in to your server, as a VPN provides complete security and encrypts all of your internet traffic, meaning that even if someone does manage to hack into your server, they won’t be able to see or access your sensitive information.

Brute Force

With brute force, an intruder attempts to guess the answer to a complex question (usually, a password). To make matters worse, many security experts state that brute force attacks are getting faster and more sophisticated every year. To prevent brute force attacks, you should never ask users to enter complex passwords, and you should change your passwords often.

Changing your passwords isn’t the only solution, of course. You can also use a one-time password generator. These types of tools allow users to create unique passwords that they can use to log in to websites, instead of having to reenter their password over and over again. In the event of a brute force attack, one-time password generators create a unique password that is difficult for the attacker to guess, as well. In many cases, just using a different password for every website you visit can prove to be sufficient enough to protect yourself from brute force attacks.

In the end, protecting your WordPress website from SQL injection and brute force attacks is something that you need to be concerned about. When it comes to preventing these types of attacks, there is no universal cure-all solution. However, if you take the time to learn how to protect yourself properly, you will be able to sleep soundly at night, knowing that even if your WordPress site is hacked, your data won’t be at risk.

To learn more, you can visit Net-Security’s website, which provides in-depth analysis of the most popular hacking techniques used these days. From there, you can access their blog, which is a great resource for learning about application security and cybersecurity in general.

The Rise In Popularity

As we mentioned above, because WordPress is so popular, it’s not a great surprise that criminals have started targeting it. However, it’s important to remember that not all hacked WordPress sites are created equal. Some hackers have gotten really, really good at compromising websites, and they’ve managed to compromise a lot of highly-trafficked blogging platforms and content management systems. They might even go as far as compromising WordPress’ core files and hacking the source code itself, leaving behind a backdoor, or exposing customer information.

Based on Net-Security’s analysis of 7 million hacked websites, we know that WordPress has been hacked at least 500,000 times in the last year alone. It’s an astonishing number of attacks, and it even exceeds the popularity of the platform itself. This is great news for anyone using WordPress, as this means that your platform is probably already patched, and you don’t need to worry about an SQL injection attack or a brute force attack. However, if you’re worried about someone compromising your WordPress site, you can take comfort in knowing that there are already security measures in place to protect it. 

It would be wise to avoid using shared hosting, as this usually means that your site’s security is unpatched and poorly-maintained. Because shared hosting is extremely cheap, this usually means that your site will be susceptible to attacks. If you have a dedicated server, however, this usually means that your site is quite safe, as dedicated servers are expensive and usually require a professional to maintain them.