- Article
- 2 minutes read
- Reviewed August 4, 2026
WordPress websites face many of the same threats as other web applications.
Popularity increases automated scanning, but the underlying risks usually involve weak credentials, outdated software, insecure code, excessive privileges or poor operational controls.
Account Compromise
Attackers can use:
- Password guessing.
- Credential stuffing.
- Phishing.
- Stolen sessions.
- Compromised email accounts.
- Reused application credentials.
Privileged accounts need stronger controls than ordinary subscriber accounts.
Vulnerable or Malicious Software
Themes and plugins can contain security defects or intentionally harmful code.
Risk increases when software is:
- Abandoned.
- Downloaded from an untrusted source.
- Modified illegally.
- Installed but unused.
- Not tested with current WordPress and PHP versions.
- Granted broad access to external services.
Cross-Site Scripting
Cross-site scripting occurs when untrusted content is rendered as executable browser code.
Prevent it through input handling, output escaping, trusted HTML allowlists and safe JavaScript practices.
SQL Injection
SQL injection occurs when untrusted data changes the meaning of a database query.
Use WordPress database APIs and prepared queries. Do not concatenate request values into SQL.
Cross-Site Request Forgery
CSRF tricks an authenticated browser into submitting an unintended request.
WordPress nonces help confirm request intent, while capabilities determine whether the current user is authorized.
File Upload Attacks
Upload workflows can be abused to store executable code, oversized files, malicious documents or unexpected formats.
Validate type, extension, size, authorization and storage behavior.
Supply-Chain Risk
A legitimate dependency can be compromised through an update channel, vendor account or build system.
Maintain backups, version records and a controlled update process.
Denial of Service and Resource Abuse
Automated logins, expensive searches, uncached endpoints and malicious requests can exhaust server resources.
Rate limits, caching, infrastructure controls and efficient code help reduce impact.
Data Exposure
Data can leak through public APIs, backups, debug logs, misconfigured storage, error output or overly broad permissions.
Classify sensitive information and minimize collection.
Frequently Asked Questions
Are most attacks targeted?
Many WordPress attacks are automated and scan large numbers of websites for known weaknesses.
Does changing the login URL stop attacks?
It can reduce noise but does not replace strong authentication, rate limits and updates.
Continue Learning
Previous: [How WordPress Security Works](/resources/wordpress-manual/security/how-wordpress-security-works/)
Next: [Creating a WordPress Security Plan](/resources/wordpress-manual/security/create-security-plan/)