WordPress powers a large share of the web, which makes it a constant target. Most WordPress compromises come from outdated plugins and themes, exposed login and XML-RPC endpoints, and information leaks.

How it happens

Plugins are added and rarely updated. The WordPress version is shown in the page source, xmlrpc.php allows password guessing at scale, and the login page has no lockout. Attackers scan for exactly these signs.

Why it matters

• Site takeover through a vulnerable plugin.
• Brute-force attacks through the login page or XML-RPC.
• Defacement, spam injection and SEO damage.

How to prevent it

• Update WordPress core, plugins and themes promptly; remove unused ones.
• Disable XML-RPC if you do not need it.
• Limit login attempts and use strong admin passwords with multi-factor authentication.
• Hide the WordPress version and remove files like readme.html and license.txt.

How Vooki Pro helps

• Detects WordPress and checks core, plugins and themes against a vulnerability database of about 17,000 entries.
• Flags an exposed XML-RPC endpoint, exposed login page and missing account lockout.
• Detects version leaks through meta tags, links and files.
• Also covers Drupal and Joomla sites.

Frequently asked questions

Should I disable XML-RPC in WordPress?

If you do not use apps or services that need it, yes. XML-RPC allows password guessing at scale and has been abused for DoS.

How are most WordPress sites hacked?

Most often through outdated or vulnerable plugins and themes, followed by weak admin passwords.

Related: Keeping third-party components up to date · Preventing information disclosure: .git, .env, backups and source maps