What causes a website to get hacked is almost never the hosting infrastructure — that’s the honest answer we give every time a customer opens a ticket asking “my site got hacked, what did you do wrong?” Nearly every time, the server wasn’t breached and the hosting infrastructure held. What actually happened traces back to one of five specific, addressable causes, none of them the host’s fault. Here they are, told honestly rather than defensively.
What Causes a Website to Get Hacked: The Five Real Reasons
Before getting into each one individually, here’s the short list of what causes a website to get hacked in the overwhelming majority of real cases we see: outdated plugins and themes, weak or reused passwords, missing two-factor authentication, pirated software, and file permission misconfigurations. Each is covered in detail below.
1. Outdated Plugins and Themes — By Far the Most Common Cause
The single biggest factor in what causes a website to get hacked is a known, published vulnerability in an outdated plugin or theme. This isn’t speculation — when a plugin developer patches a security flaw, they typically publish what changed, which effectively tells every attacker exactly what the vulnerability was and which sites are still running the vulnerable version. Automated bots then scan the internet for sites still running that outdated version and exploit it at scale, with no human attacker involved at all.
This is precisely why we wrote about choosing plugins carefully and keeping the list lean — every additional plugin is additional exposure if it goes unpatched. If you’re not running Managed WordPress with automatic updates, checking for and applying plugin and theme updates regularly is the single highest-impact thing you can do to eliminate this cause.
2. Weak or Reused Passwords
Automated attacks don’t need to guess a genuinely random password — they need you to have reused a password that’s already been exposed in a data breach somewhere else entirely. Massive databases of leaked username/password combinations circulate widely, and bots run through them systematically against login forms everywhere, including yours.
This is also why two-factor authentication matters as much as it does — it neutralizes this entire cause even when a password has been compromised elsewhere, because the password alone isn’t enough to log in anymore.
3. No Two-Factor Authentication on Admin Accounts
Related to weak passwords but distinct enough to rank separately among what causes a website to get hacked: a site with a strong, unique admin password but no 2FA is still vulnerable to phishing. If an attacker tricks an admin into entering their password on a fake login page — a well-crafted phishing email is often all it takes — a strong password provides zero protection. 2FA does, because the attacker still doesn’t have the second factor.
4. Nulled or Pirated Plugins and Themes
Premium plugins and themes downloaded from unofficial sources — “nulled” versions that bypass licensing — are a well-documented and common answer to what causes a website to get hacked. The people distributing nulled software have every incentive to embed backdoors, since they’re already distributing something illegally and the audience downloading it is specifically looking to avoid paying, making them less likely to scrutinize the source closely.
If a premium plugin or theme is worth using, it’s worth paying for. The security risk of a nulled version routinely outweighs whatever the license fee would have cost.
What causes a website to get hacked — the five real reasons
5. File Permission Misconfigurations
Less common than the causes above, but still a real answer to what causes a website to get hacked: WordPress files and directories with overly permissive access settings can allow an attacker who’s gained any initial foothold — even a small one — to write or modify files more broadly than they should be able to. Correct permissions on a standard WordPress install are typically 755 for directories and 644 for files, with wp-config.php locked down further still.
What This Means for Where Responsibility Actually Sits
The hosting server’s job is the infrastructure layer: keeping the server itself patched, running a firewall, providing malware scanning, isolating accounts from each other, and maintaining the platform WordPress runs on. We take that seriously and covered exactly what we do in our infrastructure post.
What happens inside your specific WordPress installation — which plugins you run, whether they’re current, what passwords are set, whether 2FA is enabled — is genuinely outside what a host can control on your behalf, short of literally locking you out of managing your own site. This isn’t a deflection. It’s the actual architecture of how shared responsibility works between a hosting provider and a WordPress site owner, and it’s the honest answer every time someone asks what causes a website to get hacked on infrastructure we’ve hardened as thoroughly as we have.
The Prevention Checklist That Addresses What Causes a Website to Get Hacked
- Keep plugins and themes updated, or use Managed WordPress so it happens automatically
- Use a unique, strong password for your WordPress admin — never one reused from another service
- Enable two-factor authentication on every admin account, not just your own
- Only use plugins and themes from legitimate sources — the official WordPress repository or a paid license directly from the developer
- Remove plugins you’re not actively using, rather than leaving them installed and inactive
None of this takes long, and all of it is within your direct control. If you suspect your site has already been compromised, open a support ticket immediately — the faster we can look at it, the faster we can help contain and clean it up.
Frequently Asked Questions About What Causes a Website to Get Hacked
Can shared hosting itself get hacked and affect my site?
It’s possible in theory but rare in practice on a properly configured, actively maintained server. Account isolation on modern shared hosting (via CloudLinux and similar technologies) is specifically designed to prevent one compromised account from affecting others on the same server.
How do I know if my site has actually been hacked?
Common signs: unexpected redirects, unfamiliar admin users, strange content appearing on pages you didn’t add, your site flagged by Google as containing malware, or a sudden spike in outgoing spam email.
Will reinstalling WordPress fix a hacked site?
Not by itself. A clean reinstall of WordPress core doesn’t remove malware hidden in plugins, themes, uploads, or the database. Proper cleanup requires identifying and removing the actual infected files and any backdoors left behind, not just reinstalling the base software.
The short version: What causes a website to get hacked, in the overwhelming majority of real cases, traces back to outdated plugins, weak or reused passwords, missing two-factor authentication, or pirated software — not a failure at the server level. All five causes covered here are within your control and take relatively little time to address. If your site is compromised, don’t wait to reach out — the sooner we look at it, the cleaner the recovery.