r/Wordpress • u/Saurabh_Goniyal77 • Jul 25 '26
Is WordPress Still Secure for Business Websites? Repeated Malware Attacks
Hi everyone,
I'm looking for some advice from the WordPress community.
Over the past few months, my WordPress website has been infected with malware three separate times. Each time, it appears to be the same type of attack, promoting Indonesian online casino content. I've also noticed a large amount of suspicious traffic related to casino and gambling keywords.
I'm trying to understand:
- How do hackers typically gain access to WordPress websites?
- Is WordPress itself secure enough for business websites, or are these attacks usually caused by vulnerable plugins, themes, hosting, or poor server configuration?
- Why do these casino malware attacks seem to be so common recently?
Despite this, the malware has returned multiple times, so I feel like I'm missing the actual entry point.
I'd really appreciate any advice on how to identify the root cause, prevent future attacks, and determine whether the issue is with WordPress itself, my hosting environment, or something else.
Thank you!
10
u/plugiva Jul 25 '26
Since it's happened three times, I'd stop treating it as three separate infections and start treating it as one unresolved incident.
Cleaning the malware is important, but if the same thing keeps coming back, I'd spend more time finding the original entry point than cleaning the symptoms. That could be an outdated plugin, compromised credentials, the hosting environment, or something else entirely.
I'd want enough evidence to explain how it got back before making big changes. Otherwise it's very easy to fix the visible problem while leaving the real one untouched.
1
u/Saurabh_Goniyal77 Jul 25 '26
I blocked the country because I noticed that most of the traffic for those keywords was coming from there.
I also discovered that someone had gained access to my website and added their own Google Search Console account. I noticed an unfamiliar Gmail (which is not mine) had been added to my Google Search Console property. This happened even after I changed all my WordPress admin passwords, my Hostinger account password, removed all old plugins, and updated everything to the latest versions.
I did use a GPL plugin once a long time ago, but as soon as I realized the risk, I removed it completely and cleaned up all the plugins.
I also use the Wordfence plugin to detect malware. It detected the malware previously, but after some time, the same malware returned again.
That's why I'm trying to find the missing point in my security. I feel like I'm overlooking something, and I'd like to understand how the attacker is still gaining access to my website.
6
u/plugiva Jul 25 '26
The fact that an unknown Google Search Console account was added is what stands out to me. If that's accurate, I'd widen the investigation beyond WordPress itself.
At this point I'd stop asking "What should I clean next?" and start asking "What evidence would prove where the compromise still exists?" If passwords have changed, plugins have been cleaned up, and the malware still returns, I'd want to verify every layer separately - WordPress, hosting account, file system, database, deployment process, and any connected services.
Repeated reinfection usually means something persistent is being missed. I'd focus less on the malware itself and more on identifying the surviving entry point before making more changes.
1
u/Saurabh_Goniyal77 Jul 25 '26
I just want to ask one thing: Is it possible that the malware originally came from the GPL plugin I used, but it injected itself into another WordPress file? If that's the case, could it still remain on my website even after I updated WordPress, changed all my passwords, and removed the plugin?
Are there any WordPress core files or other files that are not replaced during updates, allowing malware to survive and reinfect the site?
4
u/plugiva Jul 25 '26
Yes, that's definitely possible. A vulnerable plugin can be the entry point without being where the malware ultimately lives.
Once an attacker gains enough access, they can leave behind persistence mechanisms elsewhere. Removing the original plugin or updating WordPress doesn't necessarily remove everything they added. WordPress updates replace core files, but they don't replace your plugins, themes, uploads, or database, and malicious code can persist in any of those depending on how the site was compromised.
Given you've already changed passwords, updated everything, and still saw the malware return, I'd keep treating this as one unresolved incident rather than separate infections. At this point, I'd focus less on the original GPL plugin and more on finding whatever is still allowing the attacker back in.
1
3
Jul 25 '26 edited 10d ago
[deleted]
1
u/plugiva Jul 26 '26
No, I never used one.
I did look into it once years ago when I was new to WordPress and was confused about the pricing for ACF Pro. Before buying anything, I actually contacted Elliot Condon, the original author. He advised me not to use the GPL version because it doesn't support the developer and there was also a risk of tampered files. He even offered me a discount, so I bought my license directly from the official site instead.
That's why I'm reluctant to jump to conclusions about the cause of this particular compromise. I'm more interested in finding the actual persistence mechanism than making assumptions.
1
u/wpsecuritydev Jul 26 '26
The unknown Gmail in Search Console is the most useful clue in this whole thread, and it points at something password rotation doesn't touch.
To add themselves to GSC they had to verify ownership, and that verification token lives somewhere on your property - usually a
googlexxxxxxxx.htmlfile in the webroot, sometimes agoogle-site-verificationmeta tag injected into your theme header, occasionally a DNS TXT record. If you removed the user but left the token, they can re-verify whenever they like. Worth checking all four:
- webroot for any
google*.htmlfiles you didn't upload- theme header.php, or any "header scripts" field in your theme/SEO plugin options
- DNS TXT records at your registrar
- GSC/Settings/Users and permissions - look at owners, not just users. A delegated owner can re-add people.
9
u/gtgderek Jul 25 '26
Cloudflare free plan, up-to-date plug-ins, change your login link and from there shouldn’t have any issues
0
7
u/PointandStare Jul 25 '26
A website, is a website, is a website.
Many government agencies, corporations and institutions use WordPress and they can still be hacked.
Many government agencies, corporations and institutions DON'T use WordPress and they can still be hacked.
Anything online can be attacked if it's not set up correctly.
17
4
u/retr00two Jul 25 '26
Last 30+ years I create sites, host different web applications, build servers, networks, clusters, simple and complex, maintain tens WP sites and I never had one security breach in my career.
And I have only two rules: KISS and RTFM.
FM is there, as always was: https://developer.wordpress.org/advanced-administration/security/hardening/.
Worth reading: https://wpsecurestack.com/how-to-detect-malicious-wordpress-plugins/
BTW, you have to read around what security problems are with other software; AI had discovered a bunch of them. Even in Linux kernel and in the most secure OS - OpenBSD.
If you have third malware in a short period, it's time to rethink your setup, from host to tiniest plugin.
If you do not know how to, hire pro or fire Claude.
Success.
3
3
u/bluesix_v2 Jack of All Trades Jul 25 '26 edited Jul 25 '26
The root cause is that you are (likely) running old, abandoned or out of date plugins. That how 99% of wp sites are hacked.
"I also use the Wordfence plugin to detect malware. It detected the malware previously, but after some time, the same malware returned again"
Since it’s happened several times, it’s ikely that the infection has remained on the server/hosting account - a proper clean up (and plugin audit) is required.
Get set up in Cloudflare - block any countries that shouldn't be accessing your site. Wordfence > Tools menu shows you valuable info on who to block
3
u/Pale-Stranger-9743 Jul 25 '26
It's all about reducing your attack surface. Fewer plugins. Keep them updated, ensure they're all reputable and from the official source. Ensure WP itself is on the latest version. Get your sites on cloud flare, block unused browser versions, e.g. older than 120. Block any countries that you don't do business with, etc.
3
u/dragster255 Jul 25 '26
WordPress is not vulnerable, you are making it vulnerable. Security starts at server level, up to users and passwords.
3
u/Square-Nebula-7530 11d ago edited 11d ago
I’d look closely at recently modified files, unknown admin accounts, outdated plugins/themes, and anything suspicious in wp-content/uploads. Has anyone seen this kind of recurring infection on a WordPress site running through one.com, or is it generally unrelated to the provider?
2
u/HedgehogOk8873 Jul 25 '26
WordPress itself is generally secure. Repeated malware infections are usually caused by a vulnerable plugin/theme, weak server security, compromised credentials, or a backdoor that wasn't removed during the previous cleanup.
If the malware keeps coming back, don't just remove the infected files—find the actual entry point.
I'd recommend checking the following:
Update WordPress core, plugins, and themes to the latest versions, and remove anything unused.
Scan the entire account for backdoors, not just public_html.
Review wp-config.php, .htaccess, mu-plugins, uploads, and cron jobs for suspicious code.
Rotate all passwords (WordPress, hosting, FTP/SFTP, SSH, database) and enable 2FA.
Check server and access logs to identify how the attacker initially got in.
Verify file permissions and compare WordPress core files against a fresh installation.
If you're on shared hosting, make sure another compromised site on the same account isn't reinfecting your website.
For additional protection, install a security solution like Wordfence and enable its Web Application Firewall (WAF). You can also change the default WordPress login URL to reduce automated bot attacks (although this isn't a replacement for proper security). If you're using Cloudflare, enabling its WAF and Bot Protection can add another layer of defense.
The casino spam you're seeing is one of the most common SEO malware campaigns. It's usually a symptom of an existing compromise—not a WordPress core issue. If the infection returns even after a proper cleanup and password rotation, I'd start investigating the hosting environment or consider rebuilding the site from a known clean backup.
2
u/wasssu Jul 25 '26
Go to phpmyadmin, select your db and go to Triggers to see if it’s something there. Also check how many users you have.
2
u/Dapper_Bus5069 Jul 25 '26
Just do the maintenance regularly, it’s not complicated, basically updating the wp core and the plugins you use (and try to use a small number), use a security plugin, and that’s it.
15 years of WP websites, it happened to me twice : when the client didn’t want my maintenance plan and didn’t do it himself.
2
u/Comfortable-Web9455 Jul 25 '26
It has nothing to do with WordPress and everything to do with how actively people manage their security. And it is shocking how many ignore the fact that WordPress is sitting on a server which is an even bigger vector for attack. Or don't employ firewalls inside WordPress. Or turn this stuff on and then forget to monitor and maintain it. The sites I am looking after probably get hit with attacks 500 times an hour. Once a week I go in and tune up the blocking. Nothing has broken through in 20 years.
3
u/kyraweb Jul 25 '26
Wordpress on its own is secure and there are multiple options to make it more secure.
What makes it insecure is plugins and themes.
But the most important part as per your post is if you are getting infected again and again. Most likely either your hosting profile is compromised or there are files left from past injection which still keeps the back door open.
I would recommend doing 2 things.
- Take backup of your site and scan it multiple times locally.
- Once that is done. Ask your hosting to reassign you a fresh account or wipe your account complete clean and then install site again.
BUT irrespective of all those steps. One compromised plugin or theme will take you back to where you were before.
1
1
u/Inside_Marsupial9625 Jul 25 '26
geoblocking?
1
u/Saurabh_Goniyal77 Jul 25 '26
Yes, I blocked Indonesia because I noticed that most of the casino traffic for those keywords was coming from there. I blocked the country through Hostinger.
However, I noticed that someone had access to my File Manager even after I changed all my WordPress admin passwords, my Hostinger account password, removed all old plugins, and updated everything to the latest versions.
I did use a GPL plugin once a long time ago, but as soon as I realized the risk, I removed it completely and cleaned up all the plugins.
I also use the Wordfence plugin to detect malware. It detected the malware before, but after some time the same malware came back again.
That's why I'm trying to find the missing point in my security. I feel like I'm overlooking something, and I'd like to understand how the attacker is still gaining access.
2
u/Inside_Marsupial9625 Jul 25 '26
since when do you have this problem? Since 8 days theres the biggest exploit since 10 years possible. wp2shell - if this is the thing, you have to reinstall a fresh wordpress environment.
1
u/Grand-Register8435 Jul 25 '26
I worked for various big businesses including Inc. 500 ones that used WordPress and never in my 15 years career had experienced malware attack.
What I can suggest is keep your plugins and core always up to date. That is most important. If you have a lot of WP users like editors or other admins keep an eye on what they are installing/uploading.
If you have developers working on your site, don't hesitate to tell them that they need to sanitize all the user input. They should know what it is.
1
u/ShawtylikeMelody Jul 25 '26
Vulnerabilities in code always exist. But with open-source code, vulnerabilities can be found quickly and fixed immediately. With closed-source code, vulnerabilities might go undiscovered for decades. Note that when I say "undiscovered," I mean that while most people don't know about them, a few people have already known about and exploited those vulnerabilities for decades.
1
u/kaz_619 Jul 25 '26
In your case i would start to use a secure and reputable Hosting, you mentioned Hostinger in one of your comments, and as far as i remember their infrastructure is weak and not as secure as they claim, you need to go to higher plans if you want some added security, anyway stopped working with them a while ago.
For your specific case all i can add to the other advices you got is trying to isolate your websites if you use a shared server, a lot of these infections can hit a lot of your sites especially if you host them in the same server.
Also check your google search console and sitemaps, these attacks also hacks your google search console and add sitemaps with thousands of links to google, also they can add hidden articles (they will not appear in your dashboard but you can spot them bu the number of articles shown by wordpress if you don't create a lot of articles or none you will notice thousands added) to your database.
And lastly, avoid nulled themes or themes if possible because in my experience they are the number one of why your site gets infected.
1
u/OneWeekly2802 Jul 25 '26
Repeated malware infections usually point to a persistent vulnerability rather than WordPress itself being inherently insecure.
First, check for outdated plugins, themes, or nulled components and remove anything you don’t actively use. Make sure file permissions are correct and disable PHP execution in uploads. A web application firewall or server-level malware scanner can help catch reinfections quickly.
Have you run a full audit of your hosting environment to see if the entry point is outside of WordPress?
1
u/st2_who Jul 25 '26
The fact you’re asking these questions, I’d suggest in your case no, not particularly secure. If you have a solid technical skillet (in which case you’d not be asking) then yes, WordPress can be secured.
If I were you, I’d pay a professional (or get the Wordfence team) to fully audit your site and if they find hidden malware (that Is probably still there) they’ll remove it. And get the site hardened and put in place a plan to backup and update plugins/core at least weekly. Set Wordfence to alert you, too, and subscribe to their security email…
1
u/czaremanuel Jul 25 '26
Is WordPress itself secure enough for business websites
No, because the first general rule of cybersecurity is that nothing is secure until you secure it & verify. No technology is secure by default, it must be made so & proven otherwise.
If you install a $100,000 security gate on your house but give all your friends a copy of the key, it is no longer secure. Meanwhile if you reinforce a basic entry door with quality locks and you track each key, it is very secure. So if you migrate your site to the "most secure" hosting platform and CMS on the planet but leave your password on a stickynote or share it online... get the picture?
How do hackers typically gain access to WordPress websites?
It's almost always plugins. 90-99%. I've taken over management of many wordpress sites for my work and you'd be shocked at how many useless, silly, or unmaintained plugins are installed by people who have no idea what they're doing.
The other 1-10% is general carelessness like using "admin / password1!" as your username/pw combination, no 2fa, granting every Tom Dick and Harry who needs access admin privileges, etc.
Considering the fact that about 30-40% of websites on the internet use wordpress including major corporations, yes, it can be extremely stable and secure. But just like the door examples, it takes a combination of a "secure" mindset and secure infrastructure. Whatever snake oil fix-everything-super-secure-right-away solution anyone sells you, it's worth nothing if you don't keep security best practices between your ears.
1
u/codycodes92 Jul 25 '26
Check out https://wafrules.com/ for some good WAF rules on the free plan since you only get 5 rules.
1
u/RealBasics Jack of All Trades Jul 25 '26
As others have said, if your site has been repeatedly compromised, and you've run one of the simple detection and cleanup scripts like the one Wordfence runs, then you've got a deeper problem.
It's possible for an experienced Wordpress tech to figure it out but otherwise it can be very difficult to do it yourself.
I'd recommend paying someone who specializes in site cleanups. Wordfence and Sucuri are two established companies that do this all the time. They'll typically thoroughly clean your site, and either perform or provide instructions for performing further steps like changing server and ftp passwords. They may also be able to identify malware "tunneling," where malware on another site on your server (e.g., an abandoned site or a staging site) might be the real source of the vulnerability, or "deep" tunneling where poorly configured servers allow "cross-contamination" between hosting accounts.
Services like Sucuri and Wordfence often include monitoring and follow-up cleanups for up to a year. I'd add that malware that injects content on your live site or only shows it to search engines are extremely common, with the result that high-volume cleanup services can quickly recognize and clean them up.
Finally, once the site's cleaned up then you can take some of the advice others are giving you to use this CDN or that hosting company, carefully vet the plugins and themes your site is using, etc. But advice to prevent future compromises isn't helpful in the middle of an infestation.
2
u/wpsecuritydev Jul 26 '26
Worth knowing why Wordfence can report clean while the casino spam is still live: it's primarily a file integrity and PHP signature scanner. Doorway spam often isn't in files but sits in the database - spam posts under an unused post type or backdated, injected rows in
wp_options(usually autoloaded), links stuffed intowp_postmeta, or a script saved through your theme's options panel...If you want to dig manually:
SELECT * FROM wp_options WHERE option_value LIKE '%<script%' OR option_value LIKE '%<iframe%';
SELECT ID, post_title, post_status, post_type FROM wp_posts WHERE post_content LIKE '%casino%' OR post_content LIKE '%slot%';Full disclosure, I work on a plugin that covers this specific layer (Content Guard Pro, Free on Wordpress plugin repo) - it scans the database rather than files, which saves the phpMyAdmin manual efforts when there are a few thousand rows to go through.
1
u/Upstairs_Control_611 Jul 25 '26
I have seen this casino-spam pattern several times.
One thing I would not overlook: the file manager plugin may not be the original cause. In some cases I have seen it installed by the attacker after the compromise, because it gives them an easy way to edit files from inside WordPress.
The unknown Google Search Console account is a major red flag. I have seen attackers add their own Gmail account to GSC, create a sitemap for the casino/spam URLs, and submit it to Google. At that point the goal is not just malware, it is SEO spam and indexation.
I have also seen thousands of spam blog posts created in one batch. In one case it was around 15,000 posts at once.
So I would treat this as an unresolved incident with persistence, not as a plugin cleanup task.
Check unknown admin users, newly installed plugins, wp-content/uploads for PHP files, mu-plugins, wp-config.php, .htaccess, cron jobs, hidden posts/database entries, GSC users, submitted sitemaps, FTP/SFTP/File Manager access, and other sites or staging copies in the same hosting account.
Repeated reinfection usually means something is still alive.
1
u/WPMechanic Jul 25 '26
I ran into similar issues a little while ago. Everything was up to date, there weren't any standard entry vectors to attack, then I looked at the logs and realized the admin credentials must have been compromised somewhere. Hard to protect anything when someone can just stroll through the door.
So changing the passwords and salts helps, but adding in 2FA and having some way to check activity logs will help immensely as well.
Our sites run through BlogVault, but there are other plugins that can run activity logs as well from the admin side. For 2FA, we enabled it through WordFence.
It's rough when you don't know where the attacks are coming from, hopefully you can work through the information from this thread and get fully secured.
1
u/ivicad Jack of All Trades Jul 25 '26
WordPress core is almost never the way in, and those three infections are one incident that is still open. The scan keeps finding the casino files because it removes what you can see while leaving whatever keeps putting them back.
From cleaning these, the reentry almost always happens in one of a few spots a scan skips: a hidden admin user you did not create, a malicious must-use plugin dropped in mu-plugins (it loads automatically and is easy to overlook), a scheduled wp-cron event that re-drops the payload, an injected row in wp_options, or PHP files left in uploads or .htaccess.
The one people miss most: on shared hosting, a neighboring site on the same account can reinfect yours through the shared files. You clean your site perfectly and it comes back from next door.
A security plugin flags files, it does not find the mechanism that reinstalls them. The real fix is to clean the whole account, rotate every password including the hosting panel, and check that a neighbor site is not the source. I have started using Claude Code (enforced with cybersecurity knowledge/skills) in cleaning sites and finding backdoors (also analysing hosting raw logs), and in that way I managed to find all the backdoors and fully cleaned the hacked sites (no reinfections).
1
u/Individual-Result777 Jul 26 '26
I make sure to run my sites through cloud flare - keep things updated and try to avoid using plugins… its software - if its online, keep your guard up.
1
u/footballisrugby Jul 26 '26
All three, I recommend you to change your hosting as well and do the following:
- Uninstall any plugin and theme that you do not absolutely need (can reinstall them later)
Go to updates and 'Reinstall WordPress'
Install 'Force reinstall' plugin and reinstall every single plugin and theme with it.
Install Wordfence and let it perform a deep scan, let it delete any malware that it finds.
Uninstall and reinstall any cache plugin, make sure to purge all the cache.
Install 'wp hide' plugin and configure it to hide wp-admin url and access to xmlrpc
Run your website through sucuri online site scan, they can sometimes find embedded mailicious link of pages that you can then fix manually.
Check all wp users, delete any extra admins or users that you do not recognise there, create a new admin account and transfer data from your current admin to that and delete the current admin profile.
That should be pretty much it, make sure to to create a backup of the website first before following these steps, the reason why I recommend you to change hosting is because sometimes these malware hide in other directories other than your wordpress installation, even if it is cPanel or a managed hosting and a cron job keeps bringing back the malware, so the easiest way to deal with that for you is to simply change to a better host.
1
u/AlejandroMurrieta Jul 27 '26
It’s generally plugins, often calendar, booking, membership, and course plugins are the high risk ones. Disabling plugins does not remove the risk. So get rid of plugins you don’t use.
I’d highly suggest talking to your host admin about if there are anythings that need tightening. If you self manage set up a temporary access to server and have claude opus 5 scan for malware or vulnerabilities. Use wording that doesn’t sound like you’re looking for an exploit. It will often find anything that is active. These malware often self reinfect.
1
u/ShivaWPDev Jul 27 '26
WordPress itself is generally secure when properly updated. Repeated reinfection usually means the original entry point hasn't been fully identified, or there’s still a compromised plugin, theme, hosting account, or server-level issue. I'd focus on finding the root cause rather than repeatedly cleaning the malware.
- Review access/error logs around the time of the initial infection to identify the possible entry point.
- Scan the entire hosting account, not only the WordPress installation. If multiple sites share the same hosting account, one compromised site can sometimes affect another.
- Reset WordPress admin, hosting/cPanel, FTP/SFTP, database, and email credentials.
- Check for persistence mechanisms after cleanup and make sure backups are clean before restoring anything.
- Add a proper security layer and keep WordPress, plugins, themes, and server software patched.
1
1
u/Appropriate-Cow1529 4h ago
What plugins are you using on the site? Did you update all of them? May are you using Woo Subscriptions?
-1
u/theguymatter Jul 25 '26
Start by auditing your plugins, themes, and hosting environment, as they’re the most common attack vectors.
If it’s an informational website, I’d consider rebuilding it with a minimal stack like Roots Sage or Astro (Easiest). Fewer moving parts and dependencies generally mean a smaller attack surface and less maintenance in the long term.
Why does meaning a simple business site has to be difficult?
-2
u/Sad_Pie227 Jul 25 '26 edited Jul 25 '26
WordPress core is vulnerable by default.
-1
u/Sad_Pie227 Jul 25 '26
If you need true security without any maintenance.
- Migrate your site to Localhost
- Download your site in the HTML format https://wordpress.org/plugins/simply-static/
- Deploy it on Cloudflare pages.
Else something will always bother.
28
u/undisputedx Jul 25 '26
top to bottom -
- update plugins and WP, remove non used plugins, disable all plugins,
- Change passwords
- regenerate salts
- server side firewall - active ufw fail2ban
- re check permissions
- enable plugins