WordPress maintenance checklist: why sites get hacked and how to prevent it

A website is not finished on launch day. WordPress, its theme and its plugins receive updates every week, and many of those updates close security holes. A site that nobody looks after slowly becomes an easy target, and the first sign is often a hacked homepage, a Google warning, or a store that stops taking orders.

What the security data shows

Patchstack, a company that tracks WordPress vulnerabilities, reported these figures for 2025:

• 11,334 new vulnerabilities were found in the WordPress ecosystem, 42% more than in 2024.
• 91% were in plugins and 9% in themes. WordPress core itself had only 6.
• 46% were not fixed by the developer by the time they were made public.
• The weighted median time to the first exploit was 5 hours, and about half of high-impact vulnerabilities were exploited within 24 hours.

Source: Patchstack, State of WordPress Security in 2026. patchstack.com

In plain terms: the risk is rarely WordPress itself. It is the plugins you install, how quickly they are updated, and whether anyone notices when something goes wrong.

Why WordPress sites get hacked

• Outdated plugins and themes with known security holes.
• Pirated (nulled) themes and plugins that come with hidden malware.
• Weak or shared admin passwords, and old user accounts nobody removed.
• Plugins that were abandoned by their developers and never updated again.
• Cheap hosting with no isolation between sites, no firewall and no backups.

The maintenance checklist

Every week

• Back up the files and database, and keep the backup outside the server.
• Apply plugin, theme and WordPress updates, starting with security fixes.
• Check that the site, contact forms and checkout still work after updates.
• Look at uptime and security alerts.

Every month

• Remove plugins and themes you no longer use.
• Review admin users and remove anyone who no longer needs access.
• Check page speed on mobile and fix anything that got slower.
• Test restoring a backup, so you know it actually works.

Every year

• Renew the domain, hosting and SSL certificate before they expire.
• Renew paid plugin and theme licences, so you keep receiving updates.
• Review your privacy policy, contact details and prices across the site.

If your site is an online store, treat updates with extra care: test checkout and payment after every WooCommerce update, ideally on a copy of the site first.

If your site has already been hacked

1. Do not delete everything in a panic. Take a copy of the current site for investigation.
2. Change all passwords: WordPress admins, hosting, database and email.
3. Restore a clean backup from before the hack, or have the malware removed by a professional.
4. Update everything and remove the plugin or account that let the attacker in.
5. If Google shows a warning, request a review in Google Search Console once the site is clean.

Let us look after it for you

Cairo Cloud care plans cover WordPress, WooCommerce, plugin and theme updates, scheduled backups, security monitoring and monthly support hours. Plans start at 3,500 EGP a month, and the higher plans add daily backups, performance monitoring and priority support.

Selling online? Read how to start an online store in Egypt.