"Now my site got hacked again
Sometimes I feel it's made of glass
But that SQL injection
Took my website down and threw it on its... butt"
These are lyrics from the second half of Verse 2 in the song, "WordPress Got Ran Over By My HubSpot", which highlights one of the biggest and most well-known issues of WordPress... security.
Sophos reports that over 30,000 websites are hacked every day, and as 43% of all websites are built on WordPress, that means about 13,000 WP sites are hit daily. This of course makes it easy to believe that WordPress is by far the most hacked CMS... by a huge margin.
According to Sucuri, 4.3% of WordPress websites scanned with SiteCheck (a website security scanner) in 2022 had been hacked. That's about 1 in every 25 websites... and of course, not all WordPress sites use SiteCheck, so that is not even a complete picture.
Well, it could be due to not getting enough love and attention as a child. Wait, wrong post. There are actually a number of reasons...
As noted above, WordPress is the most used CMS platform and commands a hefty lead in market share. While that lead seems to be showing signs of a slow down (as it should), the fact remains that there is no other CMS at the moment serving as the foundation for more websites than WordPress currently does. That being said, it puts an easy target on its back. A predator wants to go where the eating is good and there are plenty of options to go after. The same goes for a hacker. They're going to take their hacking skillset to where they can exploit the most possible victims and fully take on that Grinch role in this Christmas season.
WordPress is open source, so most people are installing it and setting it up on their own. You have passwords for your MySQL database, your hosting account, and your WordPress admin login account. In many cases, there are multiple admin level accounts! Each of these logins are a potential gateway for a hacker to gain access to your site and cause significant damage, so if your passwords are weak and easily hackable, you're in trouble.
Entering the discussion, again... third party plugins. So many people proclaim WordPress' greatness due to the vast amount of plugins available. Yet, every issue that we look at with this platform seems to involve these plugins.
Every plugin, theme, or other integrated software that you are using with your WordPress site is another avenue for hackers to take into your website. As vulnerabilities are found (as they regularly are) from plugin to plugin, the developers release updates and security patches. You have to keep up on those to have the best fighting chance at keeping your WP site alive.
Over 92% of security vulnerabilities in WordPress come from third party plugins.
There are many different types of vulnerabilities, like Cross-Site Scripting (XSS), which is the most common on WordPress sites. Another type, which we have to address as our inspiration song notes it specifically, is the SQL Injection. It is one of the other most common hacking methods, and not just for WP sites.
A SQL injection attack is when the hacker sends SQL commands to the database, usually with the intention of retrieving data. WordPress is a database-driven platform, so that is where everything is housed, from page content to user login credentials. If the hacker successfully exploits a SQL injection vulnerability, they will gain unrestricted access to your database and everything that it contains.
From that point, the hacker can execute code, make changes and cause extensive damage to your website.
As we're looking at the HubSpot CMS in comparison to WordPress, how does HubSpot stack up against these type of security concerns? I'm glad you asked.
I have personally migrated a great number of clients off of WordPress and onto HubSpot's CMS Hub... and the client is always thrilled with their decision!
If you're running a website on WordPress, it's time to stop looking over your shoulder and avoiding dark hacker alleys. Get your site on a more secure environment! We can help. Let's chat.