How Do I Stop My Website From Getting Hacked?

Nobody chose your site. A bot found it. That’s better news than it sounds — because it means the fix is knowable.

---

The story

The question I get asked, always, is why me?

There’s a particular kind of hurt in it. People assume they were chosen. That some person sat down, looked at their little dental practice or their furniture shop, and decided to come after them specifically. It feels personal, and it makes them feel both violated and slightly ridiculous — who’d bother?

Nobody bothered. That’s the thing.

A script found them. It was running through IP ranges looking for one specific outdated plugin version, the way a bot tries ten thousand door handles a minute and walks through whichever one turns. Nobody knew whose site it was. Nobody cared. When the door opened, the script did what it does.

I remember finding this out about my own hack and feeling two things at once. Relief, because it wasn’t personal. And something much worse, because it wasn’t personal — which meant it was going to happen to the next unlocked door too, and the next, forever, and the only variable was whether mine was locked.

Mine wasn’t. That’s the whole story.

Here’s the direct answer

You stop your website from getting hacked by closing the doors that automated scanners actually try — which is a much shorter list than the internet suggests. In practice: keep everything updated, remove what you don’t use, enforce two-factor authentication on every admin account, restrict file permissions and login access, and run integrity monitoring that tells you when a file changes. sosSTEVIE hardens sites against the attacks that actually happen, and for clients who want the risk structurally removed, rebuilds them as static sites with no public attack surface at all.

Key Takeaways

• You weren’t targeted. A bot found a known hole. Almost every small business compromise works this way.
• The clock is brutal: about half of high-impact WordPress vulnerabilities are exploited within 24 hours of public disclosure.
• A security plugin is a smoke alarm, not a locked door.
• The most common entry points are boring: outdated plugins, reused passwords, no 2FA, abandoned admin accounts.
• Detection matters more than prevention, because damage is a function of how long it runs unnoticed.
• You can eliminate most of this category of risk entirely by not having a public login page at all.

---

The doors that actually get tried

Forget the hacker-in-a-hoodie image. Here’s how sites actually fall over.

Outdated plugins and themes. The overwhelming winner. Patchstack’s State of WordPress Security in 2026 logged 11,334 new vulnerabilities across the WordPress ecosystem in 2025 — a 42% jump on the previous year — with 91% of them found in plugins rather than WordPress core.

Now here’s the number that should actually change your behavior. According to that same report, about half of high-impact vulnerabilities are exploited within 24 hours of disclosure, and for the most heavily targeted, the median time to exploitation is around five hours.

Five hours. That’s the window. The moment a vulnerability is published, an exploit script exists and bots start sweeping for unpatched sites. Public disclosure isn’t a warning that gives you time to plan — it’s the starting gun, and the race is already most of the way run by the time you read about it over coffee.

Reused and weak passwords. Your admin password appeared in someone else’s data breach three years ago and is now in a credential-stuffing list. Nobody cracked anything. They just tried it. IBM’s 2025 breach research found attackers increasingly “log in rather than hack in,” with credential-based intrusions among the slowest of all to detect — around 246 days on average.

No two-factor. The single highest-leverage control on this page, still not enabled on most of the sites I audit. It costs nothing and it turns a stolen password into a non-event.

Abandoned accounts. The developer from 2019. The marketing agency you stopped using. The intern. Every dormant admin account is a live key held by someone who isn’t thinking about your security, and half of them are reusing the same password everywhere.

Plugins you forgot you installed. Deactivated is not uninstalled. The code is still on the server and, depending on the vulnerability, still exploitable. I regularly find sites running forty plugins where the owner can name nine.

Your hosting. Cheap shared hosting means a compromise on someone else’s site can reach yours. You did nothing wrong and you’re infected anyway.

Notice what’s not on this list: anything sophisticated. Nobody’s writing a custom exploit for your business. They don’t need to.

Why a security plugin isn’t the answer

Most people I audit believe they’re covered because they installed a well-known security plugin, and it has a green tick, and green means safe.

Here’s what actually happened. They installed it, ran the setup wizard, clicked through the defaults, and never opened it again. It’s now sending alert emails to an address nobody reads, about events nobody triages, while the plugin itself sits three versions out of date — which is a genuinely funny way to get breached, and I’ve seen it more than once.

Security plugins are useful. I install them. But a plugin is a smoke alarm: it may tell you there’s a fire, it doesn’t lock the door, it doesn’t remove the fuel, and it definitely doesn’t put anything out. Owning one and calling yourself secure is like owning a gym membership and calling yourself fit.

The uncomfortable bit: a plugin creates the feeling of being covered, and that feeling is what stops people doing the five boring things that would actually work. I’d rather you had 2FA, current updates and eleven fewer plugins than the best security suite on the market.

---

Tier one: The Locked Door Standard

Five layers. Each closes a category of attack rather than a specific exploit — which is why this doesn’t go stale every time a new vulnerability drops.

1. Reduce the surface. Delete every plugin, theme and user account you don’t need. Not deactivate — delete. This is the only security work that makes your site faster, costs nothing, and I’ve never once done it without finding something that shouldn’t be there.

2. Lock the doors. 2FA on every admin, unique credentials, least-privilege roles, restricted file permissions, disabled file editing in admin, protected login endpoint.

3. Keep it current. Automatic updates for security patches — given the five-hour exploitation window, “we update monthly” is not a security posture. Plus monitoring for plugins abandoned by their developers, because an unmaintained plugin never gets patched, so its next disclosed vulnerability is permanent.

4. Watch it. File integrity monitoring, admin account change alerts, index size monitoring, and — this is the one nobody does — an uptime check on your search presence, not just your server. My site never went down for a second. That’s exactly why it took me weeks to notice.

5. Prepare to lose. Off-site backups on a rotation long enough to predate an undetected breach, tested restores, and a written response plan. Assume you’ll be breached eventually. The whole game is how fast you find out and how cleanly you recover.

---

Tier two: The Unhackable Core

Everything above is defense. This is removal.

Here’s the thing about WordPress: nearly every vulnerability in that 11,334 needs a running WordPress installation, reachable from the public internet, executing PHP, talking to a database, with a login page at a URL every bot on earth already knows.

So don’t have one.

The Unhackable Core architecture keeps WordPress — you keep the editor you know, the workflow, the plugins you actually use — but it stops being a public website. It becomes a private backend engine, locked behind authentication and IP restriction, reachable only by you. When you publish, it generates static HTML and pushes it to Cloudflare’s edge.

What your visitors get is a folder of HTML, CSS and images served from a CDN. What an attacker gets is the same folder of HTML.

There’s no login page to brute-force, because it isn’t public. No PHP executing where visitors are, because there’s no PHP there. No database reachable from the internet, because it isn’t. The plugin vulnerability disclosed at 9am and exploited by 2pm can’t reach a machine that doesn’t answer the phone.

And it’s faster. Substantially. Static files from an edge network beat even a well-tuned WordPress install, because there’s nothing to compute — no database query, no PHP render, no cache to miss. The security architecture and the speed architecture turn out to be the same architecture, which is the rare case where you don’t have to trade.

What it costs you: anything requiring real-time server logic needs rethinking. Forms, search, comments, membership areas, live inventory — all solvable with edge functions or third-party services, but they’re decisions to make deliberately rather than assume. Publishing has a build step, so changes appear in minutes rather than instantly. And it’s a bigger up-front project than hardening.

Who it’s for: anyone who’s already been hit and can’t face it twice. Anyone whose site is a genuine revenue channel rather than a brochure. Anyone in a regulated field where a compromise is a reportable event. And anyone who wants their site to be genuinely, measurably fast.

I’m running this architecture on sosSTEVIE.com. I’d rather demonstrate it than describe it.

---

The part that matters most

Layer 4. Detection.

Everyone spends their security budget on prevention, which is understandable and slightly wrong. Prevention is a probability game you will eventually lose — a zero-day, a compromised host, an employee laptop. Given enough time, something gets through. (Unless there’s nothing there to get into, which is the entire argument for Tier Two.)

What determines the damage is dwell time: how long it runs before you notice.

IBM’s 2025 research puts the average time to identify a breach at 181 days. Six months. And breaches caught before the 200-day mark cost dramatically less than those that run longer — at enterprise scale, a difference measured in millions.

A breach caught in six hours is an incident. Annoying, contained, unremarkable. A breach caught in six weeks is thirty thousand spam pages, a torched domain reputation, and a decision about whether to start again. Same hole. Same attack. Wildly different outcome, and the only variable was the clock.

My site never went down. Never threw an error. Never looked wrong. It just quietly stopped being mine while I looked straight at it every day and saw nothing.

That’s what monitoring is for — not to stop the break-in, but to make sure you’re not the last person to know.

---

Frequently Asked Questions

Is a security plugin enough to protect my website? No. A security plugin is a smoke alarm — it may alert you to a problem, but it doesn’t close the holes attackers actually use. Most breaches I investigate happen on sites that had a security plugin installed and configured with defaults nobody revisited. Worth having as one layer among several, but on its own it mostly provides a false sense of coverage.

Why would anyone target my small business website? Nobody targeted you. Automated scripts sweep the internet for specific known vulnerabilities without knowing or caring whose site they’ve found. Patchstack’s 2026 research found the most heavily targeted WordPress vulnerabilities are exploited within a median of about five hours of public disclosure — that’s a machine working through a list, not a person choosing you. Your domain is valuable precisely because it’s an ordinary trusted site with no obvious link to the attacker.

Is a static website really more secure than WordPress? Structurally, yes — because most WordPress attacks need a live installation reachable from the internet, executing PHP against a database, with a known login URL. A static site has none of those. The Unhackable Core setup keeps WordPress as a private publishing tool and serves visitors pre-built HTML from Cloudflare, which removes the attack surface rather than defending it. It’s not literally unhackable — nothing is — but it eliminates the entire category of attack that takes down most small business sites.

What’s the single most effective thing I can do today? Enable two-factor authentication on every administrator account, then delete every plugin and user account you don’t actively use. Together those take about an hour, cost nothing, and close the two most common entry points I find. If you do nothing else on this page, do those.

Can you guarantee my site won’t be hacked? No, and nobody honest will. Hardening dramatically reduces the odds by closing the doors automated attacks actually try, and the static architecture removes most of them entirely, but any system connected to the internet carries residual risk. What I can do is make you a much harder target than the sites around you, and make sure that if something does get through, you find out in hours rather than the weeks it took me.

---

Lock the door

Nobody chose you. A script found an unlocked door, walked in, and did what scripts do. There was nothing personal in it, and there’s nothing personal in fixing it either.

But it did find mine. And I’ve spent three years making sure it doesn’t find yours.

Get your site hardened — start with the $997 Diagnostic → Already been hit? $2,950 flat-rate rescue → · or call (754) 302-4631

---

About Stevie

My site was found by a bot, through a hole I hadn’t patched, and turned into a spam farm underneath me. It never went down. It never looked wrong. I found out weeks later when the phone stopped ringing.

I do this work now because prevention is cheap and I paid the other price.

sosSTEVIE — for when your digital presence is broken, invisible, or about to be. (754) 302-4631