Millions of WordPress Sites Were Compromised Last Week. Here's What That Means for You.
A major security flaw discovered last week put millions of WordPress business websites at risk — and many owners had no idea it happened. Here's what you need to know.
Last week, a serious security vulnerability was discovered that put millions of WordPress websites at risk of being silently taken over — no password needed, no warning, nothing the site owner could have done to stop it before a patch was released.
You may have heard it called PHP2Shell. You don’t need to understand what that means technically. What matters is this: if your business website runs on WordPress, it was potentially exposed.
What actually happened
Researchers discovered a flaw in the software that almost every WordPress website runs on. Because of how common that software is, attackers were able to scan the internet and attempt to break into vulnerable sites automatically — thousands at a time, around the clock.
Once inside, they could do whatever they wanted: steal your customer data, redirect visitors to scam websites, install malware that infects your visitors’ computers, or simply hold your site hostage. In many cases, the owner had no idea anything had happened.
One government website in Europe quietly went offline when they discovered they were under active attack. Most small businesses don’t have anyone watching closely enough to notice that quickly.
Why does this keep happening to WordPress?
WordPress powers about a third of all websites on the internet. That popularity is exactly what makes it such a constant target — attackers build automated tools specifically designed to find and exploit WordPress sites because there are so many of them.
On top of that, a typical WordPress website is made up of dozens of moving parts: the WordPress software itself, a theme, and often 20 or more plugins handling everything from contact forms to SEO to security. Every single one of those is a potential entry point. When a flaw is found in any of them — or in the underlying software they all depend on — every site running it is at risk at the same time.
Last week’s flaw wasn’t even in WordPress itself. It was in the software underneath it that WordPress depends on. Which means it didn’t matter how well-maintained your WordPress site was. You were still exposed.
What happens when a WordPress site gets hacked
The consequences for a small business can be serious:
- Google blacklists your site. When Google detects malware on a website, it flags it in search results with a warning. Your traffic can drop to near zero overnight.
- Your customers get hurt. Visitors to a compromised site can have malware installed on their own devices without knowing it.
- Cleanup is expensive. Hiring someone to find and remove malware, restore your site, and get you off Google’s blacklist typically runs $500 to $2,000 or more — and that’s if the damage is limited.
- Your reputation takes the hit. Even after your site is clean, some visitors won’t come back.
How we build sites that don’t have this problem
We don’t use WordPress. We build custom websites that are, at their core, just files — not an application that runs on a server and can be taken over.
There’s no login page for attackers to target. No software to exploit. No database full of customer information to steal. When someone tries to hack your site the way WordPress sites get hacked, there’s simply nothing there for them to find.
This isn’t a special security feature we charge extra for. It’s just how our sites work.
So what should you do?
If your business website runs on WordPress, talk to whoever manages it and ask when it was last updated and whether they’ve applied the latest patches. If you don’t have anyone managing it — or if you’re not sure — that’s worth addressing sooner rather than later.
And if you’re tired of worrying about it, we’d be happy to show you what a site built the right way looks like.