Why your WordPress site keeps getting hacked.

Nobody tells you this part when you get a website. You will find out it has been hacked from someone else. A customer rings to say your site sent them to a casino. Google puts a warning under your business name. Your host emails to say the account is suspended. And the version owners describe most often is the second time: the site was cleaned, you paid for it, and within a week the spam pages are back.

This post is for the owner in that situation. Most of it is about WordPress, because that is where you are, and most of what you will find elsewhere is a comparison that turns into an advert halfway down. The fix list comes first and names no products. The part about us comes last, and it is plain about who it is not for.

What it looks like when it happens

Owners rarely say "my site has malware". They say one of these:

• Google shows pages you never wrote. Search your business name and the results are pharmacy pills, watches, casinos, or thousands of pages in a language you don't speak, all under your address.
• Visitors land somewhere else. They tap your link and end up on a different site, often only on a phone, so you never see it yourself. A customer tells you.
• A user you didn't create. Someone in your users list with full rights and a name you don't know. Sometimes your own login email has been quietly changed to theirs.
• Spam posts that come back. You delete them every morning. They reappear every night.
• The host's suspension email. "Malicious content" or "excessive resource usage", and your site is offline until you fix it or pay them to.
• "Your site is blocked." Customers' browsers or office networks refuse to open it. Nothing looks wrong from your side.
• Nothing at all. The newest infections are built not to be noticed. The dashboard looks normal, the site loads, and the only sign is that enquiries dry up and rankings slide.

That last one matters more than it sounds. In a 2026 survey of WordPress professionals reported by Help Net Security, when the first warning of an incident came from a search engine, 46% of those cases involved lost search rankings, against 14.5% of incidents found any other way. Fewer than three in ten of the people surveyed had any recovery plan at all, and those are the professionals. (Help Net Security on the Melapress 2026 survey, helpnetsecurity.com)

And then the sentence that brings most people to this page: "It was cleaned, and it's back."

Why it keeps coming back

Here is the thing nobody explained when you got the site. A WordPress site is not a set of pages sitting on a server. It is a program that runs on a server every time anyone visits, and "anyone" includes every bot on the internet. It is made of a core, a theme, and often a dozen plugins, written by different people who have never met, each running with full access to your site. Every one of them is a door.

Most of the doors are plugins. Patchstack counted 11,334 new vulnerabilities in the WordPress ecosystem in 2025, 42% more than in 2024. Ninety-one per cent were in plugins and 9% in themes; WordPress itself accounted for six. Paying for a plugin does not buy safety either: 76% of the vulnerabilities found in paid or freemium plugins were exploitable in real attacks. (Patchstack, State of WordPress Security in 2026, patchstack.com)

Updates close one door and open another. You are told to keep everything updated, and you should. But an update is also the thing that turns the site into a white screen, which is why so many owners quietly turn them off. And updating only helps if a fix exists: in the same Patchstack report, 46% of vulnerabilities had no fix from the developer by the time they were made public. A plugin whose author has moved on stays on your site, doing its job, with a hole nobody is going to patch. "Fully updated and still hacked" is a sentence the support forums know well.

A cleanup that misses one back door is a pause, not a cleanup. Sucuri's analysis of the sites it cleaned found that about half, 49%, had at least one back door installed: a hidden way back in that survives deleting the spam pages and the fake admin. (Sucuri, 2023 Hacked Website and Malware Threat Report, sucuri.net) Remove the symptoms and leave the door, and the same visitor lets themselves in again on Tuesday. That is the whole reinfection loop, and it is why a cleanup service can become a subscription: published prices run from about $99 a year for scanning to $2,000 and more for a one-off recovery. (MalCare pricing, malcare.com; Codeable, WordPress maintenance pricing guide 2026, codeable.io)

Sometimes it was never a plugin. Wordfence's cleanup team reports that compromised hosting-account passwords are a frequent way in. (Wordfence, 2024 Annual WordPress Security Report, wordfence.com) A password reused from somewhere that leaked, an old developer's login that still works; and a "free" copy of a paid theme can carry its own back door. Plenty of people did everything right on the plugin side and left the front door open.

The probes never stop. This is the part owners find hardest to believe, so here is what we see on the sites we host, none of which run WordPress. A new domain is walked by automated scanners within hours of going live. The address /wp-admin is tried every day on sites that have never been WordPress, and one hosted domain takes more than a thousand such probes a day. Nobody is targeting you. They are targeting everything, all the time, and a WordPress site is the one that answers.

Your neighbours count too. On a cheap shared plan, several sites often sit in one hosting account, and an infection in one can walk into the next. Owners of two or three sites describe cleaning one and watching it come back from the one beside it.

What to do today if you're on WordPress

If your site is on WordPress and staying there, this is the list. It names no products and links to nothing you can buy. Most of it costs nothing but an afternoon.

1. Change every password, starting with the host. Your hosting account first, then every WordPress admin, then the email address your admin uses, and the database password if your host's control panel lets you. Make each one long and different. If a developer or an old agency still has a login, this is the day it stops working.
2. Read your users list. In WordPress go to Users. Delete anyone with administrator rights you don't recognise, and check that your own account's email address is still yours. Then open your profile and remove any "application passwords" you didn't create.
3. Ask your host for a clean restore. Ask for a backup from before the infection started, not from last night. If they offer a paid cleanup instead, ask whether it finds the way in or only removes what it finds; those are different services. Ask them to check the other sites in the same account.
4. Remove what you don't use, and delete rather than deactivate. A deactivated plugin is still there on the server and still a door. Delete unused plugins and themes outright. For what remains, look at the "last updated" date: anything untouched for a couple of years is a door nobody is guarding. A Liquid Web study found 77% of WordPress users rarely or only occasionally review and remove plugins. (Liquid Web, WordPress plugin fatigue study, liquidweb.com) Never install a free copy of a paid plugin or theme.
5. Keep updates on, and back up before each one. Updates are still your best defence on WordPress. Take a backup first, every time, and keep a copy somewhere that is not the same server.
6. Turn on two-factor for every admin. And have fewer admins. Most people who edit the site only need to be an editor.
7. Tell Google when it's clean. In Search Console, look under Security issues and request a review. While you are there, check the list of owners and remove any you didn't add.
8. If it has been cleaned twice, change the question. Not "who do I pay next" but "does this site need to be a program at all?" A business site with six pages, a form and a map doesn't run anything. It just needs to be shown to people. Only one of those two things has anything in it to break into.

The other way: a site with nothing to patch

Ullbek is an AI website builder: you describe your site in plain words and it builds and publishes a real, custom website around what you said. For an owner who has been through the above, the part that matters is not what a site here has. It is what it doesn't.

• No plugins. A contact form, a gallery, a map, a booking button are just part of the page.
• No updates. There is nothing to update: no core, no plugins, no version numbers. A page that worked yesterday works today.
• No admin login page on your site. There is no door at your address for anyone to guess passwords against.
• No database to break into.
• Nothing running on your site when a visitor arrives. The probes still come. We see /wp-admin tried on our customers' sites every day, and it finds nothing to run. Nothing is metered, so a bot costs you nothing either.

We won't claim nothing can ever go wrong; nobody should, about anything with a login. Your Ullbek account is a login like any other and can be phished, so use a strong password you use nowhere else. What we can say is narrower and true: there is nothing on the site itself to patch, and nothing on it to break into.

The move itself is one request. You give it your current address and tell it what to keep.

In our tests, a six-page small-business site from its address took about 17 minutes of building, with one round of questions. The pages, menus, wording, photos, services, reviews and FAQs come across; the form is rebuilt and tested. The design is rebuilt, not copied. Every move is a redesign, which is the point. There are three ways in: from the site's address while it is still up, from a WordPress export, or from saved pages and pictures if the hosting is already gone. The move guide walks through all three.

Who this is not for

• Shops with a cart and checkout, memberships, courses, forums, booking calendars that take payment. Ullbek builds websites, not web apps, and that is a deliberate choice, not a gap. Orders and bookings here arrive as requests to your inbox, which suits a tradesperson or a clinic and does not suit a shop with four hundred products. Stay on a platform that runs programs, and do the list above.
• Blogs with hundreds of posts. In our tests a site with 56 posts and 21 pages moved in about half an hour from its export. Beyond that, ask first.
• Anyone who wants a box to type into every morning. There is no click-to-edit here. You change a page by saying what should be different, which suits a site that changes monthly and not a daily diary.
• A domain registered in a vanished developer's name. Get the domain back first; nobody but the registrar can help with that, and the move guide shows how to check.