Why Your WordPress Site Keeps Getting Hacked (And It Might Be Your Host)
You updated your plugins. You changed your admin password. You even installed a security plugin. And your WordPress site still got hacked. Again.
Most WordPress security guides focus on what you can control: strong passwords, two-factor authentication, keeping themes updated. All of that matters. But there is a layer beneath your site that many guides ignore completely: your hosting environment. A weak server configuration can leave you exposed no matter how many security plugins you stack on top.
Here is how your hosting provider might be contributing to your WordPress security problems, and what to do about it.
How WordPress Sites Actually Get Hacked
Before blaming your host, it helps to understand the most common attack vectors. Sucuri's annual hacked website report consistently shows the same patterns:
- Outdated plugins and themes account for roughly 56% of known entry points. A single vulnerable plugin is the fastest way into a WordPress site.
- Brute force attacks on wp-login.php and xmlrpc.php make up about 16% of compromises. Automated bots try thousands of username/password combinations per hour.
- Server-level vulnerabilities contribute to approximately 12% of hacks. This includes outdated PHP versions, weak file permissions, and cross-site contamination on shared servers.
- Stolen credentials from phishing, malware on your local computer, or password reuse cover the remaining cases.
That third category is entirely your host's responsibility. And it is more significant than 12% suggests, because server-level weaknesses often make the other attack types easier to exploit.
Five Ways Your Host Can Make You Vulnerable
1. Shared Server Cross-Contamination
On a shared hosting plan, your site lives on the same physical server as dozens (sometimes hundreds) of other websites. If one of those sites gets compromised, the attacker may be able to reach your files too.
This happens through symlink attacks, where the hacker exploits how Linux handles symbolic links to read files outside their own directory. It can also happen through shared temporary directories, where PHP session files or upload folders are accessible to all accounts on the server.
Good hosts prevent this with proper account isolation. SiteGround uses custom account isolation technology on their shared plans (starting at $2.99/mo, renewing at $17.99/mo). Cloudways avoids the problem entirely by giving each customer their own virtual server, starting at $14/mo.
Budget shared hosts often skip or poorly implement account isolation. If your site has been hacked and you are on a $1-2/mo plan, cross-contamination from a neighbor's site is a real possibility.
2. Outdated PHP Versions
PHP 7.4 reached end of life in November 2022. PHP 8.0 followed in November 2023. Running WordPress on an unsupported PHP version means you get zero security patches for known vulnerabilities in the language itself.
Yet many budget hosts still default new accounts to PHP 7.4 or even 7.3. Some do not offer PHP 8.2 or 8.3 at all.
As of early 2026, here is PHP support across popular hosts:
| Provider | PHP 8.1 | PHP 8.2 | PHP 8.3 | PHP 8.4 | Auto-Update |
|---|---|---|---|---|---|
| Kinsta | Yes | Yes | Yes | Yes | Yes (managed) |
| WP Engine | Yes | Yes | Yes | Yes | Yes (managed) |
| SiteGround | Yes | Yes | Yes | Yes | Manual switch |
| Cloudways | Yes | Yes | Yes | Yes | Manual switch |
| Hostinger | Yes | Yes | Yes | Yes | Manual switch |
| A2 Hosting | Yes | Yes | Yes | Check | Manual switch |
| Scala Hosting | Yes | Yes | Yes | Check | Manual via SPanel |
Managed WordPress hosts like Kinsta ($29.17/mo yearly) and WP Engine ($30/mo yearly) automatically handle PHP updates. Kinsta even notifies you before upgrading and lets you test in a staging environment first. This alone significantly reduces your attack surface.
3. Missing or Weak Web Application Firewall (WAF)
A WAF sits between the internet and your website, filtering malicious requests before they reach your WordPress installation. It blocks SQL injection, cross-site scripting (XSS), and known exploit attempts targeting popular plugins.
Not all WAFs are equal. A basic WAF uses pattern matching and blocklists. An advanced WAF uses behavioral analysis and machine learning to detect novel attacks.
| Provider | WAF Included | WAF Type | DDoS Protection | Malware Scanning |
|---|---|---|---|---|
| Kinsta | Yes | Cloudflare Enterprise | Yes | Yes |
| WP Engine | Yes | Proprietary + WAF | Yes | Yes |
| Cloudways | Yes | Cloudflare Enterprise | Yes | Yes |
| SiteGround | Yes | Custom AI WAF | No (basic) | No (add-on) |
| Hostinger | Yes | Built-in WAF | Yes | Yes |
| A2 Hosting | Yes | ModSecurity + rules | No | Yes (HackScan) |
| Scala Hosting | No (VPS) | SShield AI instead | No | Yes (SShield) |
SiteGround's WAF is notable because they write custom rules within hours of new WordPress vulnerabilities being disclosed. So even if you have not updated a vulnerable plugin yet, SiteGround's firewall is likely already blocking the exploit.
4. No Automatic Backups (Or Bad Ones)
Backups do not prevent hacks, but they determine how quickly you recover from one. A site without recent backups can be down for days or permanently lost.
The critical questions are: how often does your host back up, how many restore points are kept, and are backups stored separately from your server?
Kinsta creates automatic daily backups with 14-day retention (30 days on higher plans). Every backup is stored on Google Cloud, separate from your live server. You can also create manual backups before making changes.
WP Engine offers daily automated backups with a simple one-click restore. Backups include files and database.
Many budget shared hosts include backups but only on a weekly schedule. InterServer provides weekly backups on standard plans, with daily backups reserved for Boost plans. If your site gets hacked mid-week, you could lose several days of content and orders.
5. No Staging Environment for Safe Updates
The most dangerous moment for a WordPress site is right after an update. A plugin update can introduce a new vulnerability. A theme update can break compatibility with a security plugin. Testing updates on a staging copy before pushing them live reduces this risk dramatically.
SiteGround includes a staging tool on GrowBig ($4.99/mo) and GoGeek ($7.99/mo) plans. Kinsta and WP Engine include staging on every plan. Cloudways also provides staging environments.
Most budget shared hosts do not include staging at all. You end up updating plugins directly on your live site and hoping nothing breaks.
What a Secure WordPress Host Looks Like
The ideal security stack from your host includes:
- Account isolation (no cross-contamination from other sites on the server)
- Current PHP versions with regular updates
- Server-level WAF with rules updated for new WordPress exploits
- Daily automatic backups stored off-server
- Free SSL certificates (Let's Encrypt or equivalent)
- Staging environments for safe testing
- Malware scanning and removal
- DDoS protection
Only a few hosts check every box. Kinsta and WP Engine come closest, but they cost $29-30/mo at the entry level. Cloudways offers most of these features starting at $14/mo, making it the best security-to-price ratio for WordPress sites that have outgrown basic shared hosting.
The Shared Hosting Security Tradeoff
Shared hosting is not inherently insecure. SiteGround and Hostinger both run solid security on their shared plans. But the economics of $2-3/mo hosting mean certain compromises are inevitable.
Resources for security monitoring are limited. WAF rules may be less aggressively updated. Account isolation exists but is less robust than a dedicated container or virtual server. Backup frequency is lower.
If your WordPress site handles customer data, processes payments, or generates significant revenue, the $14-30/mo for managed or cloud hosting is not a luxury. It is a cost of doing business. A single hack can cost thousands in lost sales, recovery work, and damaged reputation.
For a personal blog or portfolio? Shared hosting from SiteGround or Hostinger with a good security plugin (Wordfence or Solid Security) is probably fine. Just stay on top of updates.
Your Security Checklist (Host + Site Level)
Things Your Host Should Handle
- Server-level firewall and WAF
- PHP version management
- Account/container isolation
- Automatic backups
- SSL certificate provisioning
- DDoS mitigation
Things You Need to Handle
- Keep WordPress core, themes, and plugins updated
- Use strong, unique passwords for all accounts
- Enable two-factor authentication on wp-admin
- Remove unused themes and plugins (deactivated is not enough)
- Limit login attempts (most security plugins do this)
- Change the default "admin" username
- Disable XML-RPC if you do not need it
- Use SFTP instead of FTP for file transfers
Recommended Hosts by Security Priority
| Priority Level | Best Host | Price | Why |
|---|---|---|---|
| Maximum security | Kinsta | From $29.17/mo | GCP + Cloudflare Enterprise, daily backups, malware removal included |
| High security, lower budget | Cloudways | From $14/mo | Isolated servers, Cloudflare Enterprise, staging, DDoS protection |
| Best shared hosting security | SiteGround | From $2.99/mo | Custom WAF with rapid rule updates, account isolation, staging on GrowBig+ |
| VPS with AI security | Scala Hosting | From $29.95/mo | SShield AI protection, full server control via SPanel |
If your WordPress site has been compromised more than once, the pattern usually points to one of two problems. Either you are not keeping plugins updated, or your hosting environment is too permissive. Fix both, and repeat hacks become extremely unlikely.
Need help comparing specific hosts? Check out our shared vs managed WordPress hosting breakdown or use the Kinsta vs WP Engine comparison to see how the premium options stack up.
