For most of the web's history, getting hacked took a person. Someone had to find your site, poke at it, recognise the plugin you were running, and know an exploit for it. That was never a great defence, but it was a real one: small businesses were mostly protected by being boring.
That protection is gone. Attackers now run fleets of automated tools, increasingly steered by AI, that scan the entire internet, fingerprint every site they touch, and try working exploits the moment a new vulnerability is published. Nobody chooses your site. A machine simply finds it.
Here's what that shift looks like in practice, why it changes the maths on hosting, themes and plugins, and what a small business can actually do about it.
What "automated hacking" means now
Three things have converged over the last few years, and each one removes a step that used to require a human.
- Internet-wide scanning is cheap. Tools that sweep every public IP address and catalogue what's running there are free, fast and constantly rerunning. Your site is in that catalogue whether you've ever advertised it or not.
- Fingerprinting is automatic. A scanner doesn't need to guess. It reads your page source and knows within seconds that you're on WordPress, which theme you use, and which plugins are installed, often with exact version numbers.
- Exploits arrive with the disclosure. When a vulnerability in a popular plugin is announced, working exploit code follows almost immediately, and AI-assisted tooling has made writing and adapting that code faster still. Mass exploitation campaigns now start within hours of a disclosure, not weeks.
Put those together and you get a very different threat than the one most people picture. There is no hacker "targeting" your bakery, your law practice or your nonprofit. There is a script that tried the same known hole on two hundred thousand sites overnight, and yours was one of the ones that hadn't been patched yet.
Where AI actually changes things
It's easy to wave the phrase "AI era" around, so let's be specific about what has changed and what hasn't.
Speed. Turning a vulnerability write-up into a working attack used to require skill and time. Language models are good at exactly that kind of translation. The gap between "patch available" and "attack in the wild" has collapsed, which means the old habit of updating "when you get around to it" is now a genuine liability.
Scale of the follow-through. Breaking in was always the easy part. What happens next used to be manual: someone planting spam pages, harvesting customer data, or setting up a phishing kit on your domain. That work is increasingly automated too. A compromised site is monetised within minutes, and it's often done quietly enough that you don't notice for weeks, while Google does.
Convincing phishing. The emails that trick your staff into handing over the admin password are no longer riddled with typos. They read like they came from your host, your registrar or your own IT person, because a model wrote them that way.
What hasn't changed: the holes themselves. The overwhelming majority of WordPress compromises still come down to the same short list: an outdated plugin or theme, a weak or reused password, or a host that lets one compromised site infect its neighbours. AI made the attackers faster. It didn't invent new ways in. That's the good news, because the fixes are known.
Why plugins and themes are the front door
WordPress core itself is well maintained and rarely the way in. The risk lives in the ecosystem around it. A typical small-business site runs a theme plus somewhere between ten and thirty plugins, each written by a different author with a different level of care, and each one is code running on your server with the same privileges as everything else.
A few habits that made sense in 2018 are actively dangerous now:
- Deactivated but not deleted. A plugin you switched off is still on disk, still reachable, and still exploitable. If you're not using it, remove it.
- "Nulled" or pirated premium themes. Free copies of paid themes are one of the most reliable ways to install a backdoor on your own site. The saving is not worth it.
- Abandoned plugins. If a plugin hasn't been updated in a couple of years, nobody is going to patch the next vulnerability found in it. Replace it before that happens.
- Everything auto-updating blindly, or nothing updating at all. Both are wrong. Updates need to happen quickly, but with a backup first and a check afterwards, because a bad update can take the site down just as surely as an attacker can.
The right posture is boring and disciplined: fewer plugins, from maintained sources, patched on a schedule measured in days, with a tested backup you can roll back to. We covered the mechanics in how your WordPress site gets hacked, and they're more relevant now than when we wrote it.
Why hosting matters more than it used to
Hosting used to be a commodity decision: pick the cheapest plan with enough storage. In an automated-attack world, the host is a big part of your defence, and cheap shared hosting fails in three specific ways.
Neighbours. On budget shared hosting, hundreds of sites live on one server, often with weak isolation between them. One neighbour running an abandoned plugin can become the beachhead for everyone on the box. You can do everything right and still get infected through the wall.
No one at the edge. A modern setup puts a web application firewall in front of the site that blocks known exploit patterns and abusive scanners before they reach WordPress at all. That single layer stops the bulk of automated traffic. Most bargain hosts don't provide it, and the ones that do rarely tune it.
Nobody watching. The difference between a hack that costs you an hour and one that costs you a business is how fast someone notices. Daily malware scanning, uptime monitoring, and a person whose job is to respond are what turn a compromise into an incident instead of a catastrophe.
This is exactly the gap managed WordPress hosting exists to close. It isn't about faster servers, though that's part of it. It's that the host is doing the security work: isolation, firewall, scanning, backups and a human on call.
A practical checklist for the next 30 days
You don't need a security team to get ahead of automated attacks. You need to close the handful of doors the scripts are checking.
- Know what you're running. List every plugin and theme, who maintains it, and when it was last updated. Delete anything you don't use.
- Patch within days, not months. Core, themes and plugins. If you can't commit to that yourself, that alone is a reason to hand it to someone who will.
- Fix the login. No "admin" username. Long, unique passwords from a password manager. Two-factor authentication on every administrator account. Limit login attempts.
- Put a firewall in front of the site. Either through your host or a service like Cloudflare, so exploit attempts are dropped before they touch PHP.
- Back up daily, offsite, and test a restore. A backup you've never restored is a hope, not a plan. Our guide to backups and downtime monitoring walks through what "good" looks like.
- Scan yourself before someone else does. Run a free, non-invasive scan of your site to see what a scanner sees: exposed versions, missing headers, obvious misconfigurations.
- Decide now who you'll call. If the site is compromised at 9pm on a Friday, who fixes it, and how fast? Having that answer in advance is worth more than any plugin.
If you've already been hit
Don't delete anything, don't restore a random backup over the top, and don't just change the password and hope. Automated attackers leave multiple backdoors precisely so that the obvious fix doesn't work. A proper cleanup means finding how they got in, removing everything they left behind, closing the hole, and then hardening the site so the same script doesn't walk back in tomorrow. That's what our flat-fee hacked site cleanup does, with a response inside four business hours.
The bottom line
The internet didn't get more dangerous because attackers got smarter. It got more dangerous because they got automated, and automation doesn't care how small you are. The defences haven't changed: maintained plugins, a clean theme, disciplined updates, hardened logins, a firewall, tested backups and a host that takes security seriously. What's changed is the cost of skipping them.
If keeping up with all of that isn't how you want to spend your week, that's what a Wurdey care plan is for: hosting, updates, backups, security and monitoring handled by a team, from $49 a month, with a written response-time commitment when something goes wrong.
Next step
Find out what a scanner sees on your site.
Run a free, non-invasive scan in about a minute. You'll get a plain-English security grade and the fixes that matter, no signup required.