Your WordPress Site Gets Hacked. The Phone Stops Ringing. Plug These Holes Quick.

Bob's phone had a quiet week in March.

Not dead. Quiet. Four calls instead of nine. He put it down to the weather, then to the time of year, then to nothing in particular, because that is what you do when one week is soft. He had a busy April lined up and he stopped thinking about it.

His site had been hacked since February.

Nobody called to tell him. There was no message on his dashboard and no email from anybody. His site loaded fine. The pictures of the trucks were still there. What had changed was that Google had quietly stopped trusting it, and a page nobody ever showed him was serving something to strangers in another country.

That is what getting hacked actually looks like for a small business. Not a skull on the screen. A soft month you cannot explain.

And then there is the part after, which nobody has ever described to Bob, because everybody stops the story at "you got hacked."

TL;DR (the short answer)

Getting hacked is not one bad file you delete. In the first quarter of 2026, Wordfence detected malware on about 474,000 of the more than 5 million sites it protects, which is roughly 9 in 100. Across those sites it saw 27.4 million unique malware files, and the average infected site was carrying 51.8 malicious files. Cleanup means finding all of them, because leaving one behind lets the site get reinfected. Most of those sites were running software that had a patch available and never got it.

3 Things to Remember

474,000 Sites. Out of More Than 5 Million.

I am going to give you both numbers in the same breath, because one without the other is a scare tactic.

In Q1 2026, Wordfence detected malware on about 474,000 sites. Wordfence protects more than 5 million sites. (Wordfence, 2026)

That is roughly 9 in 100. It is not everyone, and anybody telling you the whole platform is on fire is selling something. It is also not nobody. Nine out of a hundred is one street of shops in your town.

Here is the number that actually changes how you think about it.

Across those infected sites, Wordfence saw 27.4 million unique malware files, and the average infected site was carrying 51.8 malicious files. (Wordfence, 2026)

Fifty-two. On one site. That is not somebody dropping a file and leaving. That is somebody moving in.

You Find Out From a Quiet Month.

This is the part I want to spend real time on, because it is the part that costs you money before anybody says the word "hacked."

A modern site compromise is not built to be noticed. Whoever did it wants your server, your traffic, or your good name with Google, and all three of those work better if you never look.

So your homepage stays normal. Your form still sends. Meanwhile there are pages on your domain you have never seen, serving whatever the attacker is selling, and Google is reading them.

Then Google does the thing Google does. It stops trusting the domain. Your listings slide. The map pack forgets you. Nobody calls to explain and nothing shows up on your screen. Your phone just gets quieter.

I wrote about how that trust collapse works in what a hack does to your Google standing. The short version is that the traffic damage starts before you know anything is wrong.

The mistake: waiting for something obvious to happen before you check.

The fix: when a month goes soft for no reason, check the site before you blame the season.

The payoff: you catch it in weeks instead of quarters, and there is less to clean up.

Now Go Find the Other 51.

Here is the cleanup nobody describes.

You find one bad file. Maybe your host flags it, maybe a scanner does. You delete it. You feel like you handled it.

The average infected site has 51.8. (Wordfence, 2026) So you handled roughly 2% of it.

The rest are not sitting in a folder called "bad files." Wordfence's own breakdown is useful here: PHP files are often webshells, backdoors, infostealers and skimmers, while JavaScript and HTML files are usually spam. (Wordfence, 2026) That means the pieces are doing different jobs and living in different places. Some are the way back in. Some are the payload. Some are just there so the others survive a cleanup.

That is why "I deleted the bad file and it came back" is one of the most common sentences in this whole business. It came back because you removed the payload and left the door.

And the average infected site carried 2.4 different malware variations. (Wordfence, 2026) It is not one intruder with one tool. It is often more than one thing, layered.

The mistake: treating cleanup as deleting what you found.

The fix: treat it as finding everything, which means a full file scan against known signatures, not eyeballing folders.

The payoff: it stays gone, and you are not doing this again next month.

What the Weekend Actually Costs.

Nobody bills you for "a hack." You get billed for the pieces, and the pieces stack up.

• The cleanup. Either you pay somebody, or you spend a weekend learning file structures you never wanted to know.
• The reinfection. If one backdoor survives, you do it again. This is the one that turns a bad weekend into a bad month.
• The passwords and keys. Every credential on that site has to be treated as gone. Database, host, email service, anything the site connected to.
• The Google recovery. Getting the trust back takes longer than getting the files out, and no invoice covers it.
• The quiet weeks. The jobs you never heard about while the phone was soft. That number is real and you will never know what it was.

Not one of those is the file you deleted.

Plug These Holes Quick. Here Is the Short List.

The title promises this, so here it is, plainly. These are the things that put most sites in that 474,000.

• Update everything today, then find out who owns doing it every month. Most infected sites were running something with a patch available that nobody installed. This is the single biggest one.
• Pull the plugins nobody maintains. Anything with no update in over a year, or a red closure bar on its WordPress.org page, is the profile that gets hit. I went through the abandoned-software problem in the post on holes with no patch at all.
• Get two-factor on every admin account. Wordfence blocked 16.0 billion brute force attempts in Q1 2026 alone. (Wordfence, 2026) That is the front door, and it is being tried constantly.
• Cut admin accounts down to the people who need them. The web guy from 2019 does not need one.
• Have a backup you have actually restored. Not "we have backups." A backup nobody has tested is a story, not a plan.
• Run a real malware scan on a schedule, not when you get worried. You are looking for 52 files, not one.

That list is not exciting and it is not new. It is what actually separates the 9 from the 91.

You are a plain-talking website helper. My site is [PASTE YOUR WEBSITE URL] and it runs WordPress. Here is what I have noticed: [DESCRIBE IT, for example fewer calls than usual, a drop in traffic, a warning from my host, or nothing at all and I just want to check].

Walk me through this in order, on my phone, in plain words.
1) The fastest checks that cost nothing and catch a silent hack, step by step, starting with Google Search Console and a site: search on my own domain.
2) Exactly what a bad result looks like in each one, so I know what I am looking at.
3) How to tell the difference between a hack and a normal slow month.
4) If something looks wrong, the order to do things in, and why changing passwords before cleanup is the wrong order.
5) The exact questions to ask my host, and what a good answer sounds like.

Rules: short sentences, no jargon. If you have to use a technical word, explain it in the same sentence. Do not tell me to buy anything.

A Site With No Moving Parts Has Nothing to Reinfect.

The reason my builds do not have this problem is boring. There is no code running on the server that a stranger can talk into doing something.

A WordPress site builds every page fresh when somebody visits. It runs code, asks the database a pile of questions, loads every plugin, and hands back a page. Every one of those steps is somewhere a file can be planted and somewhere a backdoor can hide.

The sites I build are already built. The pages are finished files sitting on a fast network. A visitor arrives and there is nothing to run.

That is not me being clever. It is fewer moving parts, and 52 files have nowhere to live. That is the whole idea behind the 100K Website, and it is why I say the old machine is done for real business sites.

And watching it is my job. You go run your business.

Where This Is Not WordPress's Fault.

I will give the other side its full due here, because it is the strongest counterpoint in this whole run.

Most of those 474,000 sites were not hacked because WordPress cannot be secured. They were hacked because they were running software with a patch available that nobody installed. That is a maintenance failure, not a platform failure, and a well-run WordPress site with few plugins, current versions, two-factor on the admin accounts and a real backup is a genuinely hard target.

The detection side is also working hard. Wordfence released 89 new malware signatures in that one quarter and blocked 9.1 billion firewall attacks. (Wordfence, 2026) That is a serious defense operating at a scale most software has no version of.

Now the turn. Every bit of that depends on somebody watching your site every single week, forever, and noticing things a busy owner has no reason to notice. That person exists at big companies. On Bob's site, that person is Bob, and Bob is on a roof.

The worst part of getting hacked is not the files. It is the four weeks before you knew, and the quiet phone you could not explain.

Your website should be the boring part of your week. It should not be a thing you have to go looking for problems in between jobs.

Let me show you what a site with nothing to clean up actually feels like, built on your own market.

Take a Test Drive →

You get a real look at your own market. No obligation, and nothing to cancel.

Want the whole playbook first? Plan your attack. Balls Out Marketing.

FAQ

This is post 6, the last in a run on WordPress security. Post 1 covered the hole in WordPress core that needed no password. Post 2 covered the 30 plugins that got bought and backdoored. Post 3 covered the contact form that let strangers upload files. Post 4 covered the fix that shipped in March and got attacked through June. Post 5 covered the holes with no fix at all. This one is what happens when one of them lands.