A lot has changed in the last few years. Technology has improved faster than we could have ever imagined. There are many things to celebrate and appreciate, but when it comes to your website’s security, some of the efficiencies gained from AI bots are less than desirable. At 434, we’re prepared to support you with the regular management and maintenance of your website, with human oversight.
Ten years ago you knew you’d been hacked because your homepage said so. Someone put their name on it, maybe a flag, maybe a message. Embarrassing, obvious, fixed by Friday.
That barely happens now. What happens instead is nothing.
TL;DR
- Nobody’s defacing websites anymore. What’s happening instead is worse, and it’s quiet.
- Nearly half of compromised sites still had a backdoor sitting in them at cleanup.
- Five hours. That’s the median time from a WordPress vulnerability going public to getting attacked at scale. Almost half have no patch available yet when that happens.
- 91% of last year’s 11,334 new WordPress vulnerabilities live in plugins, not in WordPress itself.
- AI didn’t invent a new attack. It just removed the skill needed to run the old ones. We anticipate the volume of attacks to continue to increase.
- A scanner checks you against what’s already known. The gap before a patch exists, that still takes a person to discern the right next step.
-> See our site maintenance prices
What a break-in looks like now
The attacker gets in, creates an administrator account that looks like it belongs, drops a small file somewhere in your plugins folder, and leaves. Your site keeps working. Your forms keep submitting. Nothing on the page changes.
Nearly half the compromised sites cleaned in the last full industry study already had a backdoor sitting in them at the time of cleanup. Not the attack — the way back in, left behind on purpose.
They’re not robbing the house. They’re unlatching a window on the way out.
What that window gets used for later varies. Sometimes it’s spam pages built on your domain, invisible to you and visible to Google. Sometimes it’s a redirect that only fires for visitors arriving from a search result, so you never see it and your customers always do. Sometimes it sits unused for months, until somebody buys a list of compromised sites and your domain is on it.
The first sign is rarely a defaced page. It’s a Search Console warning, a payment processor flagging your checkout, or a customer asking why your site sent them somewhere strange.
Why this scaled
2025 brought 11,334 new security vulnerabilities to the WordPress ecosystem — up 42% over the year before. 91% of them were in plugins, not in WordPress itself.
That number matters more than it looks. WordPress core is maintained by a large, coordinated, well-funded team. The average plugin is maintained by one or two people who also have day jobs. The exposure isn’t the platform. It’s the twenty-odd things bolted onto it that make it do what your business actually needs.
And writing a working exploit used to take real skill. It doesn’t anymore. A published vulnerability is a description of a flaw; turning that description into working code is now a task a model finishes in minutes. The floor dropped, and the volume followed it.
Five hours
Here’s the number that changed how we think about this.
The median time from a vulnerability being made public to being attacked at scale is now five hours. Nearly half are attacked within a day.
And today, 46% of them have no patch available at the moment they’re disclosed.
Read those two together. For roughly half of new vulnerabilities there’s a period (sometimes hours, sometimes weeks…) where the flaw is public knowledge, working exploit code is circulating, and there is no update to install. Doing the responsible thing isn’t an option yet, because the responsible thing doesn’t exist.
That gap is the whole problem. It isn’t “are your plugins up to date.” It’s what happens during the window when up to date isn’t available.
The old methods aren’t enough
In August, a WordPress plugin developer with more than 100,000 installations was compromised; not through a flaw in their own code, but through a third-party data feed their plugin pulled from.
Sites running it got hidden administrator accounts and a backdoor built for quiet re-entry. Nothing visible happened. No site owner did anything wrong. They had installed a legitimate plugin from a legitimate developer and kept it updated, which is exactly what everyone tells you to do.
That’s the part worth sitting with. Every piece of standard advice was followed, and it didn’t matter, because the compromise arrived through a channel nobody was watching.
Why a scanner isn’t the answer
Scanning is necessary. We do it. But a scanner compares your site against a list of things already known to be wrong, and most of what’s above happens outside that list.
Three things need a person.
- The window. When a vulnerability is public and no patch exists, somebody has to decide what to do for the next thirty-six hours — disable the feature, put a rule in front of it, or accept the risk and watch it closely. A scanner can tell you you’re exposed. It can’t choose.
- The updates themselves. Auto-updating everything breaks sites; we’ve cleaned up after it. Updating nothing leaves holes open. So someone has to look at what changed, on which site, and decide what goes now and what waits. That isn’t a setting. It’s a judgment call, site by site.
- What’s already inside. A backdoor is built to look like it belongs. You don’t find it by scanning once. You find it by knowing what a site normally looks like and noticing when it doesn’t.
What we do about it
So the answer isn’t a better scanner. It’s a firewall standing in front of the site during the window when no patch exists yet. Plugins reviewed by a person on a real schedule, with somebody deciding what goes now and what waits. And monitoring that knows what a site normally looks like, so the thing built to blend in doesn’t.
None of that makes a website unhackable, and anyone telling you otherwise is selling something. What it does is shrink the window and make sure somebody is looking.
Why we’re telling you this
I’ve been helping clients with their websites since 2011. Along the way that turned into an agency. And now we are the backend support for our clients’ websites. The plan was always stewarding other people’s money and time and resources as carefully as we’d steward our own. So, in 2026, when hacks are more prevalent than ever, we’re still here, stewarding your brand’s front door.
At 434, we don’t have a sales team. We have people who vouch for us.
That’s why a post like this isn’t a pitch. It’s an offer to be in your corner. When something changes about what keeps a website safe, we change our approach, and then we charge what it costs. In that order. We don’t send a letter in January explaining that costs have gone up — if nothing had changed, nothing would change.
Things changed this year. So we did as well.
If you’re not sure whether anyone is watching your site, we’re here to step into that gap.
Keep Reading
